cve/2025/CVE-2025-26788.md

CVE-2025-26788

Description

StrongKey FIDO Server before 4.15.1 treats a non-discoverable (namedcredential) flow as a discoverable transaction.

POC

Reference

• https://www.securing.pl/en/cve-2025-26788-passkey-authentication-bypass-in-strongkey-fido-server/

Github

• https://github.com/EQSTLab/CVE-2025-26788
• https://github.com/PuddinCat/GithubRepoSpider
• https://github.com/nomi-sec/PoC-in-GitHub