Impersonation Vulnerability in Yubico WebAuthn Server

CVE-2026-46419

What is CVE-2026-46419?

The Yubico webauthn-server-core (also known as java-webauthn-server) prior to version 2.8.2 contains a critical flaw in the second factor flow. Specifically, the vulnerability arises from incorrect validation of a function's return value, thereby enabling an attacker to impersonate a legitimate user. This significant security oversight highlights the importance of thorough return value validation in authentication processes to maintain secure user sessions.

References