Authentication Bypass Using an Alternate Path or Channel Affecting io.quarkus:quarkus-security-webauthn package, versions [,3.18.0.CR1)

Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel through the default REST endpoints. An attacker can bypass authentication controls and potentially log in as an existing user without proper credentials by exploiting these endpoints. This is only exploitable if custom REST endpoints are provided by developers but the default endpoints are not disabled.

This vulnerability can be mitigated by disabling the default endpoints after creating a custom one. For example with the call for:

import io.vertx.ext.web.Router;
import jakarta.enterprise.event.Observes;
public class Startup {
public void init(@Observes Router router) {
System.err.println("Securing WebAuthn default controller");
router.post("/q/webauthn/callback").order(0).handler(rc -> rc.fail(404));
}
}

• GitHub Commit
• Red Hat Bugzilla Bug