High · published July 29, 2025
⚡ A lingering WebAuthn challenge is like leaving your front door ajar after locking up! Discourse versions prior to 3.4.7 allow session reuse, creating a security risk that's surprisingly sneaky! 🔒 Think of it as a restaurant's reservation system that forgets to clear your table after you leave. If someone else can use that table without confirming who they are, it creates an opening for trouble! An attacker could potentially sign in as an authenticated user, reusing an old challenge and gaining unauthorized access to sensitive data. This could lead to data breaches, compromised user accounts, and a loss of trust within your community.
Think of it as a restaurant's reservation system that forgets to clear your table after you leave. If someone else can use that table without confirming who they are, it creates an opening for trouble! This vulnerability arises because the WebAuthn challenge remains active in a user’s session after authentication instead of being cleared. This flaw can allow an attacker to exploit the session if they gain access to the challenge.
An attacker could potentially sign in as an authenticated user, reusing an old challenge and gaining unauthorized access to sensitive data. This could lead to data breaches, compromised user accounts, and a loss of trust within your community. Update Discourse to version 3.4.7 or newer on the stable branch, or version 3.5.0.beta.8 on the tests-passed branch to eliminate this risk. Review user sessions for possible unauthorized access as an additional precaution. You've got this! Follow these steps to secure your community and keep it safe! 🛡️