High severity7.5NVD Advisory· Published May 14, 2026· Updated May 14, 2026

CVE-2026-46419

Description

Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a function's return value in the second factor flow, leading to impersonation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Yubico/Java Webauthn Serverreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: >=2.8.0,<2.8.2

Patches

Vulnerability mechanics

References

github.com/Yubico/java-webauthn-server/releases/tag/2.8.2nvd
www.yubico.com/support/security-advisories/ysa-2026-02/nvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000