New Api EUVD-2026-14522

While the CVSS 4.9 score appears moderate, multiple risk signals elevate concern: the attack vector is network-based with low complexity (AV:N/AC:L), but critically requires high privileges (PR:H), meaning only authenticated users can exploit this. The CVSS impact is high confidentiality (C:H) with no integrity or availability impact, indicating selective information disclosure. The lack of available patches significantly increases real-world risk—organizations cannot remediate through standard patching. The authentication bypass nature and requirement for prior account compromise (to be authenticated) create a moderate-to-moderately-high practical risk profile. This is NOT a low-risk CVSS quirk; it represents a genuine step-up authentication failure with no patch available, forcing operational workarounds. SSVC analysis suggests this requires exploitation of existing authentication (not zero-day escalation from unauthenticated), making it more of a privilege refinement than lateral movement, but the absence of remediation paths elevates urgency.

An authenticated user who has enrolled a passkey for step-up authentication initiates a sensitive operation (such as API key generation or user role elevation) that triggers secure verification. Due to the logic flaw, the user can satisfy the verification challenge without completing the full WebAuthn assertion—for example, by omitting the signature verification step or completing a truncated challenge-response. The system incorrectly treats this incomplete assertion as valid, granting access to the privileged operation. This is a straightforward low-complexity attack requiring only network access and prior authentication, making it trivial to exploit once a user discovers the bypass.