Vulnerabilities in WebAuthn Standard Implementations

Abstract

The WebAuthn standard enables passwordless authentication using asymmetric cryptography and addresses several well-known vulnerabilities of traditional password-based authentication. Despite the formally proven security of the standard itself, practical implementations often contain server-side flaws that allow authentication bypass. This article addresses the vulnerability of incorrect credential binding to a user account, which allows an attacker to take over another user's account using their own valid credential. A review of four CVE vulnerabilities from 2025 and 2026 shows that server-side flaws recur in credential binding, cryptographic challenge handling, and origin validation. An intentionally vulnerable demonstration application and its patched version were developed: the attack bypasses authentication on the vulnerable version and is rejected on the patched one. A comparison of four widely-used libraries shows that three leave credential binding to the application, while one requires it at the interface level. The analysis yields developer guidelines, among them strict credential-to-user binding. The security of WebAuthn-based systems is not an automatic consequence of library or language choice, but requires explicit server-side verification of credential ownership.