CVE-2024-12225

The Quarkus WebAuthn module automatically publishes default REST endpoints supporting user registration and login. If a developer defines their own replacement endpoints, the default ones are not disabled and remain accessible from the network. An attacker can direct a request directly to the default endpoint, thereby bypassing any additional security logic implemented in custom endpoints. As a result, it is possible to obtain a session cookie without actual authentication (WebAuthn mechanism bypass) or hijack an existing user's session by providing only their username.

An attacker can log in to the application as any existing user by knowing only their username, or obtain a valid session cookie without any associated account — leading to unauthorized access and potential breach of application data confidentiality and integrity.

Apply patches available from the vendor according to references (Red Hat: https://access.redhat.com/security/cve/CVE-2024-12225). As a temporary workaround, block access to default WebAuthn endpoints at the firewall level or application server configuration if they are not required.

Applications built on the Quarkus framework using the quarkus-security-webauthn module, in which a developer has defined their own custom REST endpoints replacing the default ones; versions indicated in vendor references