VDB
CISA-2025-6433
CISA-2025-6433
PUBLISHED
CVSS 9.8 CRITICAL
Reported by mozilla · Published June 24, 2025
If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the user would be prompted to complete. This is in violation of the WebAuthN spec which requires "a secure transport established without errors". This vulnerability affects Firefox < 140 and Thunderbird < 140.
Risk Scores
CVSS 3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | unspecified |
| Mozilla | Thunderbird | unspecified |
| Mozilla | Firefox | *, unspecified |
| Mozilla | Thunderbird | *, * |
Timeline
- Jun 24, 2025 CVE Published
- Oct 30, 2025 CVE Updated