External risk intelligence

FIDO2 Credential Registration Vulnerability Allows Account Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-19117

The vulnerability is explicitly restricted to on-premises deployments only, which typically implies a focus on internal, isolated environments rather than public-internet-facing infrastructure.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in on-premises deployments that could allow an attacker to register a malicious credential and then impersonate a legitimate user. The issue bypasses standard authentication mechanisms, potentially leading to unauthorized access and control of targeted accounts.

Attackers can impersonate users with stolen credentials.
Critical access risk if on-premises systems are exposed.
Confirm relevance; on-premises deployments are the focus.

Attack Path

How an attacker could exploit the issue

An attacker could target an organization's on-premises systems to register a fraudulent FIDO2 credential associated with a legitimate user account. Once registered, this malicious credential could be used to authenticate as the targeted user, granting the attacker access to their account. This vulnerability could potentially allow an attacker to gain unauthorized access and control over user accounts within the affected on-premises environment.

No authentication or special privileges are needed.
Registering a malicious FIDO2 credential.
Unauthorized account access and control.

Live Threat

Current exploitation, exposure, and threat context

Under specific conditions in on-premises deployments, an attacker could register a fraudulent FIDO2 credential to impersonate a targeted user, potentially leading to unauthorized access.

Target account credentials.
Attacker registers malicious FIDO2 credential.
Unauthorized account access may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given this vulnerability affects only on-premises deployments, the primary responsibility for remediation likely falls to infrastructure or platform teams, in conjunction with application owners who manage the target accounts. The initial, critical step is to inventory all on-premises systems where the affected technology is deployed, determine their business criticality and external reachability, and identify the accountable system owner. This will inform a risk-based remediation plan, coordinating efforts to mitigate the threat.

Application and infrastructure teams own remediation.
Verify on-premises deployment and account reachability.
Plan and execute remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the software affected by CVE-2026-19117?

This CVE concerns systems supporting FIDO2 authentication protocols, which provide secure, passwordless login methods using physical security keys or biometrics. These on-premises deployments are typically managed locally by organizations to handle user identity verification and access control for their internal applications and sensitive infrastructure.

How would you describe the vulnerability in CVE-2026-19117?

This issue is classified as CWE-290, which refers to an Authentication Bypass by Spoofing. In simple terms, the system fails to correctly verify the origin or legitimacy of a FIDO2 security key during the registration process. Because the validation check is flawed, an attacker can trick the system into accepting a fraudulent credential as if it were a valid, user-owned device, granting them the ability to log in as that user.

What does an attacker need to trigger this vulnerability?

An attacker must be able to interact with the registration workflow of an on-premises system to submit a malicious FIDO2 credential. No prior authentication, special user privileges, or existing account access are required to initiate this process. Importantly, this flaw is not triggered by standard user logins; it is specifically bound to the registration phase where new security devices are linked to an account.

Do I need to worry if my systems are not internet-facing?

According to Halo Surface Signal, this vulnerability is very unlikely to be exploited externally because it is strictly limited to on-premises deployments. Since these environments are usually kept within internal, isolated networks, the risk is significantly lower for systems that cannot be reached from the public internet.

When should I begin my response to this advisory?

You should start by creating an inventory of all on-premises systems that handle FIDO2 authentication. Identify which of these are critical to your operations and determine if any might be reachable from outside your protected network. Once you have a clear map of these assets, coordinate with your infrastructure and application teams to prioritize security updates or configuration changes based on the business importance of those specific systems.

References

delinea.com/security-advisories

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.