CVE-2023-45669

WebAuthn4J Spring Security provides Web Authentication specification support for Spring applications. Affected versions are subject to improper signature counter value handling. A flaw was found in webauthn4j-spring-security-core. When an authneticator returns an incremented signature counter value during authentication, webauthn4j-spring-security-core does not properly persist the value, which means cloned authenticator detection does not work. An attacker who cloned valid authenticator in some way can use the cloned authenticator without being detected. This issue has been addressed in version `0.9.1.RELEASE`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-287

• https://github.com/webauthn4j/webauthn4j-spring-security/commit/129700d74d83f9b9a82bf88ebc63707e3cb0a725Patch
• https://github.com/webauthn4j/webauthn4j-spring-security/security/advisories/GHSA-v9hx-v6vf-g36jVendor Advisory
• https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-sign-counterTechnical Description
• https://github.com/webauthn4j/webauthn4j-spring-security/commit/129700d74d83f9b9a82bf88ebc63707e3cb0a725Patch
• https://github.com/webauthn4j/webauthn4j-spring-security/security/advisories/GHSA-v9hx-v6vf-g36jVendor Advisory
• https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-sign-counterTechnical Description

Published

Oct 16, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-45662stb_image is a single file MIT licensed library for processi…8.1
• CVE-2023-45663stb_image is a single file MIT licensed library for processi…5.5
• CVE-2023-45664stb_image is a single file MIT licensed library for processi…8.8
• CVE-2023-45665Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2023-45666stb_image is a single file MIT licensed library for processi…9.8
• CVE-2023-45667stb_image is a single file MIT licensed library for processi…7.5
• CVE-2023-4567Rejected reason: Issue has been found to be non-reproducible…
• CVE-2023-45670Frigate is an open source network video recorder. Prior to v…6.8
• CVE-2023-45671Frigate is an open source network video recorder. Prior to v…4.7
• CVE-2023-45672Frigate is an open source network video recorder. Prior to v…7.5
• CVE-2023-45673Joplin is a free, open source note taking and to-do applicat…9
• CVE-2023-45674Farmbot-Web-App is a web control interface for the Farmbot f…6.5