golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed

CRITICAL 9.1CVE-2026-39831 · GHSA-89gr-r52h-f8rx · GO-2026-5019 · Published 22/05/2026 · updated 23/07/2026

Package	Affected versions	Patched versions
golang.org/x/crypto Go	`< 0.52.0`	`0.52.0`
crypto golang	`< 0.52.0`	`0.52.0`

Description

The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2026-39831 · ADVISORY
cs.opensource.google/go/x/crypto · PACKAGE
go.dev/cl/781662 · WEB
go.dev/issue/79566 · WEB
groups.google.com/g/golang-announce/c/a082jnz-LvI · WEB
pkg.go.dev/vuln/GO-2026-5019 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free