ZIPLINE · CVE-2026-126952 · Package
FIX → 4.4.1 ✓ verified
Zipline, a self-hosted file sharing server, has a flaw in its WebAuthn (passkey) login endpoint that creates a session for any registered credential ID without checking the signed assertion. An attacker who learns a user's passkey credential ID can log in as that account and potentially gain SUPERADMIN control.
first public Jan 20, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted Zipline 4.4.0 or earlier with passkey login enabled is exposed. The login endpoint creates a session for a registered credential ID without checking the signed assertion. An attacker needs the genuine credential ID of the target's passkey. If that account is a SUPERADMIN, the attacker gets admin control. Instances without passkeys enabled, or on 4.4.1 or later, can skip it.
Not affected if no-registered-passkeys, passkey-login-disabled
Who cares passkeys, self-hosted, webauthn, zipline
Upgrade to 4.4.1
v4.4.1 or later (current releases are 4.8.x)Zipline through 4.4.0 contains an authentication bypass vulnerability in the WebAuthn login endpoint that creates sessions for a supplied registered credential ID without verifying the assertion. Attackers who obtain a target's passkey credential ID can impersonate that account without its authenticator, potentially gaining administrative control over SUPERADMIN accounts.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.