A WebAuthn record could be updated from the public key
Passkey bugs are often recovery or record-keeping bugs, not a break of the ceremony. Quote the score the program settled on. The public key is not a secret, so it is a weak name for a write.
- Original severity
- Low (3.1) source-reported; not rescored by vulns.co
- Public source
- hackerone disclosure
- Program / vendor
- Nextcloud
- Product / surface
- WebAuthn app
- Weakness
- Insecure direct object reference · CWE-639
- Affected boundary
- An authenticator record identified by a public key the caller supplied
- Disclosure date
- 2026-02-06
- Public status checked
- 2026-09-26
- Public attribution
- se1en
What the evidence established
The disclosed report is titled as an update of a WebAuthn record based on the public key. The program resolved it, assigned CVE-2025-66558, paid a bounty, and lowered the score from high to low before disclosure.
Why the impact was credible
The source reported that an authenticator registration could be changed by someone who knew the public key rather than by the account that owned it.
Durable engineering lesson
Passkey bugs are often recovery or record-keeping bugs, not a break of the ceremony. Quote the score the program settled on. The public key is not a secret, so it is a weak name for a write.
Control pattern
Bind authenticator updates to the authenticated account. Do not use the public key as the only identifier for a write.
Primary public disclosure
Upstream availability and wording can change. Public status was last checked 2026-09-26.