Spring Security
Approved changes feed: RSS · Atom
cpe:2.3:a:webauthn4j:spring_security:*:*:*:*:*:spring:*:*part: a version: * update: *
| Vendor | Webauthn4J (9794ec5d-80c8-55c4-a8de-0d8c1d98f7a1) |
|---|---|
| Product | Spring Security (ae353a68-fe94-505c-9768-5b4bdecd34c4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | spring |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/webauthn4j/webauthn4j-spring-security |
purl2cpe | 2026-06-01 10:12:06.635343 |
pkg:maven/com.webauthn4j/webauthn4j-spring-security-core |
purl2cpe | 2026-06-01 10:12:06.635344 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-45669 |
vulnerable | 2026-06-08 06:12:43.083718 |
Improper signature counter value handling in webauthn4j-spring-security
MEDIUM (4.8)
WebAuthn4J Spring Security provides Web Authentication specification support for Spring applications. Affected versions are subject to improper signature counter value handling. A flaw was found in webauthn4j-spring-security-core. When an authneticator returns an incremented signature counter value during authentication, webauthn4j-spring-security-core does not properly persist the value, which means cloned authenticator detection does not work. An attacker who cloned valid authenticator in some way can use the cloned authenticator without being detected. This issue has been addressed in version `0.9.1.RELEASE`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Published: 2023-10-16T18:20:50.301Z
Updated: 2024-09-13T19:36:56.097Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.