Horizon Alert
Summary of the vulnerability and why it matters
This advisory highlights a critical vulnerability in Zipline's WebAuthn login functionality that could allow unauthorized access to accounts, including administrative ones, by bypassing authentication through a compromised credential ID. The main concern is confirming relevance and exposure to affected systems.
- Bypass authentication using a credential ID.
- Administrative account access is at risk.
- Confirm relevance and potential exposure.
Attack Path
How an attacker could exploit the issue
An attacker could exploit this vulnerability by first obtaining a user's passkey credential ID. With this ID, they can then bypass authentication on the WebAuthn login endpoint, allowing them to create a new session. This could grant them unauthorized access, potentially including administrative privileges if they target a SUPERADMIN account.
- Requires obtaining a target's credential ID.
- Triggers through a WebAuthn login bypass.
- Risk of account impersonation and admin control.
Live Threat
Current exploitation, exposure, and threat context
The Zipline WebAuthn login endpoint could allow an attacker to bypass authentication. This is possible when an attacker obtains a target's registered credential ID, enabling them to create a session without the need for the target's authenticator. This could lead to unauthorized access to accounts, including those with administrative privileges.
- Account access and administrative control.
- Bypassing authentication using a credential ID.
- Unauthorized administrative access to SUPERADMIN accounts.
Operational Fix
Recommended remediation, mitigation, and detection steps
The Zipline application owner and platform team are likely responsible for addressing this authentication bypass vulnerability. The first practical move is to identify all Zipline instances, confirm their exposure and criticality, and then assign an accountable owner to plan remediation.
- Application and platform teams own the issue.
- Verify Zipline instances and their reachability.
- Plan remediation based on confirmed risk.
