CVE-2026-126952: Zipline through 4.4.0 WebAuthn Authentication Bypass via Passkey Login
Zipline through 4.4.0 contains an authentication bypass vulnerability in the WebAuthn login endpoint that creates sessions for a supplied registered credential ID without verifying the assertion. Attackers who obtain a target's passkey credential ID can impersonate that account without its authenticator, potentially gaining administrative control over SUPERADMIN accounts.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs a registered passkey credential ID for the target account. They do not need the target's authenticator, prior authentication, or user interaction.
Which accounts are at greatest risk?
Any account using a registered WebAuthn credential may be impersonated if its credential ID is obtained. SUPERADMIN accounts are specifically at risk of administrative takeover.
How can I determine whether an attempted login may have exploited the flaw?
Review WebAuthn/passkey login activity for sessions created for accounts without evidence that a valid WebAuthn assertion was verified. The provided information does not identify a specific log field or detection signature.