WebAuthn's Achilles' Heel: Browser Flaws Let Attackers Steal Credentials

SlowMist Technology Chief Information Security Officer 23pds has issued a warning about potential vulnerabilities in WebAuthn key login systems, highlighting new attack methods that could compromise authentication protocolstitle2^[2]. The researcher noted that attackers can exploit malicious browser extensions or cross-site scripting (XSS) vulnerabilities on websites to hijack the WebAuthn API. This allows adversaries to force a downgrade to password-based authentication or manipulate key registration processes, enabling credential theft without requiring physical access to the device or biometric authentication like Face IDtitle2^[2]. The risks are particularly acute for users relying on key login systems on websites with unpatched vulnerabilities or compromised extensions, as this could lead to identity impersonation and account breachestitle2^[2].

A critical vulnerability, CVE-2025-6433, has been identified in Firefox versions prior to 140, where users granting exceptions for invalid TLS certificates can be prompted to complete WebAuthn challengestitle1^[1]. This bypasses the WebAuthn specification’s requirement for secure transport during authentication, creating a pathway for attackers to exploit certificate validation flawstitle1^[1]. The vulnerability, rated as "Critical" with a CVSS score of 9.8, could enable system compromise or data leakage. Affected products include Firefox and Thunderbird versions before 140title3^[3]. The exploit works by leveraging user interaction—when a user visits a malicious website with an invalid TLS certificate and grants an exception, the site can trigger a WebAuthn challenge, effectively bypassing standard security protocolstitle3^[3].

Researchers at enterprise browser security firm SquareX further demonstrated how passkey-based login systems, which rely on WebAuthn, can be manipulated through compromised browser environmentstitle4^[4]. The attack involves injecting malicious JavaScript to forge WebAuthn registration and login flows. By convincing users to install a malicious browser extension or exploiting XSS vulnerabilities on a targeted website, attackers can reinitiate passkey registration processes or force victims to revert to password authentication. This bypasses the cryptographic security of passkeys, which are designed to resist phishing attackstitle4^[4]. The attack does not target the cryptographic layer of passkeys but instead exploits weaknesses in the browser’s implementation of WebAuthn APIstitle4^[4].

The implications of these vulnerabilities underscore the need for robust mitigation strategies. For users, ensuring browser extensions are from trusted sources and avoiding granting exceptions for invalid TLS certificates is criticaltitle1^[1]. Organizations should prioritize updating to patched versions of Firefox (v140+) and Thunderbird (v140+) to address CVE-2025-6433title1^[1]. Developers are advised to validate certificate errors rigorously and implement secure coding practices to prevent XSS vulnerabilities that could be leveraged to hijack WebAuthn processestitle4^[4].

WebAuthn, developed by the W3C and FIDO Alliance, aims to replace traditional passwords with public key cryptographytitle2^[2]. However, these findings highlight that its security is contingent on proper implementation and the absence of browser or application-level flaws. Analysts note that while WebAuthn remains a strong defense against phishing compared to password-based MFA, its adoption has been slowtitle5^[5]. The vulnerabilities emphasize the importance of continuous monitoring and updates to maintain the integrity of passwordless authentication systemstitle5^[5].