Critical · published June 24, 2025
🚨 A simple click could make your WebAuthn credentials vulnerable! If a user visits a webpage with an invalid TLS certificate and grants an exception, they could unknowingly fall into a trap! 🔥 This is like letting a stranger into your house because they promised to fix your broken window, while they actually plan to take your valuables instead — it's a huge breach of trust and security! An attacker could exploit this vulnerability to trick users into completing a WebAuthn challenge over an insecure connection, jeopardizing sensitive authentication credentials. This could lead to unauthorized access to accounts, potentially giving attackers the keys to your digital kingdom. Absolutely devastating!
This is like letting a stranger into your house because they promised to fix your broken window, while they actually plan to take your valuables instead — it's a huge breach of trust and security! This vulnerability violates the WebAuthn specification by allowing a WebAuthn challenge to be issued over a faulty TLS connection, which should have been deemed insecure and blocked entirely.
An attacker could exploit this vulnerability to trick users into completing a WebAuthn challenge over an insecure connection, jeopardizing sensitive authentication credentials. This could lead to unauthorized access to accounts, potentially giving attackers the keys to your digital kingdom. Absolutely devastating! Update Firefox and Thunderbird to version 140 or later immediately to close this dangerous loophole. Additionally, educate users on the importance of verifying TLS certificates before granting exceptions. This is crucial for keeping their information safe! You've got this! Patch up those browsers and keep your digital treasures secure! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| mozilla/firefox | < 140.0 | 140.0 |