Critical · published April 3, 2024
🚨 This one’s a real doozy: an unauthenticated attacker can hijack an account just by registering their FIDO key! 🔥 Think of it like a hotel where anyone can sneak into the lobby, forge a room key, and walk right into someone else’s suite—no reservation required! If exploited, this vulnerability could allow an attacker to completely take over a victim’s account, potentially leading to unauthorized access to sensitive information and total account control. Imagine waking up to find someone has swiped all your secrets while you were sleeping!
Think of it like a hotel where anyone can sneak into the lobby, forge a room key, and walk right into someone else’s suite—no reservation required! This CVE allows an internal attacker, who passes enrollment verifications, to register their FIDO authenticator for a victim's account through the WebAuthn API, effectively enabling account takeover without proper authentication checks.
If exploited, this vulnerability could allow an attacker to completely take over a victim’s account, potentially leading to unauthorized access to sensitive information and total account control. Imagine waking up to find someone has swiped all your secrets while you were sleeping! Immediate action is crucial! Update VeridiumID to version 3.5.0 or later to close this vulnerability. Additionally, review your enrollment verification processes to ensure they are robust and secure. 🛡️ You’ve got this! Just follow these steps and you’ll be back in control of your accounts in no time! ⚡