| Package | Affected versions | Patched versions |
|---|---|---|
| veridiumad | < 3.5.0 | 3.5.0 |
In VeridiumID before 3.5.0, the WebAuthn API allows an internal unauthenticated attacker (who can pass enrollment verifications and is allowed to enroll a FIDO key) to register their FIDO authenticator to a victim’s account and consequently take over the account.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free