Ranljivosti pri implementaciji standarda WebAuthn
TL;DR
The vulnerability of incorrect credential binding to a user account is addressed, which allows an attacker to take over another user's account using their own valid credential.
Abstract
The WebAuthn standard enables passwordless authentication using asymmetric cryptography and addresses several well-known vulnerabilities of traditional password-based authentication. Despite the formally proven security of the standard itself, practical implementations often contain server-side flaws that allow authentication bypass. This article addresses the vulnerability of incorrect credential binding to a user account, which allows an attacker to take over another user's account using their own valid credential. A review of four CVE vulnerabilities from 2025 and 2026 shows that server-side flaws recur in credential binding, cryptographic challenge handling, and origin validation. An intentionally vulnerable demonstration application and its patched version were developed: the attack bypasses authentication on the vulnerable version and is rejected on the patched one. A comparison of four widely-used libraries shows that three leave credential binding to the application, while one requires it at the interface level. The analysis yields developer guidelines, among them strict credential-to-user binding. The security of WebAuthn-based systems is not an automatic consequence of library or language choice, but requires explicit server-side verification of credential ownership.