-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @better-auth/passkey | npm | < 1.4.0 | 1.4.0 |
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe analysis of the provided security patch (commit 06d68239e) clearly indicates an authorization flaw in the passkey function located in packages/passkey/src/index.ts. The vulnerability is an Insecure Direct Object Reference (IDOR). The patch adds a crucial check to the passkey deletion logic. Previously, the code only used the passkey id from the request body to identify the passkey to be deleted. The fix introduces an additional condition to the database query, requiring the userId of the passkey to match the ID of the user in the current session. This ensures that a user can only delete their own passkeys. Therefore, the passkey function is identified as the vulnerable function, as it contained the flawed logic that processed the deletion request without proper authorization checks.
passkeypackages/passkey/src/index.ts
Ongoing coverage of React2Shell