CVE-2025-6433

The WebAuthn specification requires that authentication only occurs through secure transport established without errors. In vulnerable Firefox versions, if a user visited a website with an invalid TLS certificate and manually approved a security exception, the browser did not block the ability of that website to send a WebAuthn request (challenge). The user was then prompted to perform it, even though the connection did not meet the secure transport requirements. This allows a malicious or compromised website to link the user's authentication data with an untrusted connection.

An attacker controlling a website with an invalid TLS certificate can trick a user into performing WebAuthn authentication in an untrusted context, which may lead to credential theft or bypass of identity verification mechanisms. The integrity and confidentiality of the authentication process is compromised.

Mozilla Firefox should be updated to version 140 or later and Mozilla Thunderbird to version 140 or later, in accordance with the manufacturer's information published in security advisories MFSA2025-51 and MFSA2025-54

Mozilla Firefox versions prior to 140 and Mozilla Thunderbird versions prior to 140