{"id":"CVE-2026-126952","kind":"vulnerability","aliases":["CVE-2026-126952"],"related":[],"title":"Zipline: WebAuthn login accepts a credential ID, letting attackers impersonate users","description":"Zipline through 4.4.0 contains an authentication bypass vulnerability in the WebAuthn login endpoint that creates sessions for a supplied registered credential ID without verifying the assertion. Attackers who obtain a target's passkey credential ID can impersonate that account without its authenticator, potentially gaining administrative control over SUPERADMIN accounts.","summary":"Zipline, a self-hosted file sharing server, has a flaw in its WebAuthn (passkey) login endpoint that creates a session for any registered credential ID without checking the signed assertion. An attacker who learns a user's passkey credential ID can log in as that account and potentially gain SUPERADMIN control.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"zipline","fixed":["4.4.1"],"affected":"<= 4.4.0","ecosystem":"github"}],"ecosystems":[],"tags":["package","passkeys","self-hosted","webauthn","zipline"],"not_affected_if":["no-registered-passkeys","passkey-login-disabled"],"how_to_check":"- Check the running Zipline version; v4.4.0 is the affected release per the GitHub advisory (VulnCheck says through 4.4.0).\n- Check whether passkeys are enabled and whether any user has registered a passkey. The advisory says the bypass applies when passkeys are enabled; it does not state the default.\n- An attacker needs the real credential ID of a passkey registered to the target account.","fix":"Upgrade to Zipline v4.4.1 or later (current releases are 4.8.x). If you cannot upgrade, disable passkey authentication.","status":"open","published_at":"2026-11-13T10:18:02+00:00","first_seen_at":"2026-11-13T10:47:28+00:00","triaged_at":"2026-11-13T10:48:33+00:00","updated_at":"2026-11-13T10:49:57+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T10:48:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Zipline: WebAuthn login accepts a credential ID, letting attackers impersonate users","impact":"high","summary":"Zipline, a self-hosted file sharing server, has a flaw in its WebAuthn (passkey) login endpoint that creates a session for any registered credential ID without checking the signed assertion. An attacker who learns a user's passkey credential ID can log in as that account and potentially gain SUPERADMIN control.","audience":"businesses","category":"package","nicknames":[],"who_cares":["zipline","self-hosted","passkeys","webauthn"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker logs in as any user, including SUPERADMIN accounts","analyst_note":"Confirm the fixed version and whether passkey login is on by default, using the vendor advisory on github.com and the VulnCheck advisory.","how_to_check":"- Check the running Zipline version, which the sources say covers all releases through `4.4.0`.\n- Look for whether passkey (WebAuthn) login is enabled on the instance; the sources do not describe a default.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["passkey-login-disabled"],"who_is_affected":"Teams that self-host Zipline with WebAuthn passkey login enabled are exposed, since the endpoint creates sessions for known credential IDs without verifying the assertion. Instances that do not use passkey login, or that are behind managed hosting, are likely not affected; the sources do not confirm this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000752,"input_tokens":4618,"output_tokens":580,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether passkey login is on by default, using the vendor advisory on github.com and the VulnCheck advisory.","search":"'-126952':14A,17A '-2026':13A,16A '4.4.0':80C 'accept':4A 'account':72B,116C,126C 'administr':122C 'assert':56B,103C 'attack':9A,58B,104C 'authent':83C,119C 'bypass':84C 'check':53B 'contain':81C 'control':77B,123C 'creat':44B,92C 'credenti':6A,50B,65B,98C,111C 'cve':12A,15A 'endpoint':42B,90C 'file':31B 'flaw':36B 'gain':75B,121C 'host':23B,30B 'id':7A,51B,66B,99C,112C 'imperson':10A,114C 'learn':60B 'let':8A 'log':68B 'login':3A,41B,89C 'obtain':106C 'packag':19B 'passkey':20B,40B,64B,110C 'potenti':74B,120C 'regist':49B,97C 'self':22B,29B 'self-host':21B,28B 'server':33B 'session':46B,93C 'share':32B 'sign':55B 'superadmin':76B,125C 'suppli':96C 'target':108C 'user':11A,62B 'verifi':101C 'vulner':85C 'webauthn':2A,24B,39B,88C 'without':52B,100C,117C 'ziplin':1A,25B,26B,78C 'zipline':18A","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Zipline 4.4.0 or earlier with passkey login enabled is exposed. The login endpoint creates a session for a registered credential ID without checking the signed assertion. An attacker needs the genuine credential ID of the target's passkey. If that account is a SUPERADMIN, the attacker gets admin control. Instances without passkeys enabled, or on 4.4.1 or later, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-13T10:49:57Z","by":"analyst","doc":"https://github.com/diced/zipline/security/advisories/GHSA-8g3f-425r-35rq","run_id":3852},"mitigations":{"at":"2026-11-13T10:49:57Z","by":"analyst","doc":"https://github.com/diced/zipline/security/advisories/GHSA-8g3f-425r-35rq","run_id":3852},"workarounds":{"at":"2026-11-13T10:49:57Z","by":"analyst","doc":"https://github.com/diced/zipline/security/advisories/GHSA-8g3f-425r-35rq","run_id":3852}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["zipline"],"ptokens":["zipline"],"labels":["critical","package","passkeys","selfhosted","webauthn","zipline"],"campaign_type":null,"search_a":"'-126952':14A,17A '-2026':13A,16A 'accept':4A 'attack':9A 'credenti':6A 'cve':12A,15A 'id':7A 'imperson':10A 'let':8A 'login':3A 'user':11A 'webauthn':2A 'ziplin':1A 'zipline':18A","search_b":"'account':72B 'assert':56B 'attack':58B 'check':53B 'control':77B 'creat':44B 'credenti':50B,65B 'endpoint':42B 'file':31B 'flaw':36B 'gain':75B 'host':23B,30B 'id':51B,66B 'learn':60B 'log':68B 'login':41B 'packag':19B 'passkey':20B,40B,64B 'potenti':74B 'regist':49B 'self':22B,29B 'self-host':21B,28B 'server':33B 'session':46B 'share':32B 'sign':55B 'superadmin':76B 'user':62B 'webauthn':24B,39B 'without':52B 'ziplin':25B,26B","search_c":"'4.4.0':80C 'account':116C,126C 'administr':122C 'assert':103C 'attack':104C 'authent':83C,119C 'bypass':84C 'contain':81C 'control':123C 'creat':92C 'credenti':98C,111C 'endpoint':90C 'gain':121C 'id':99C,112C 'imperson':114C 'login':89C 'obtain':106C 'passkey':110C 'potenti':120C 'regist':97C 'session':93C 'superadmin':125C 'suppli':96C 'target':108C 'verifi':101C 'vulner':85C 'webauthn':88C 'without':100C,117C 'ziplin':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-01-20T01:11:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126952","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126952","severity":null,"published_at":"2026-11-13T10:18:02+00:00","modified_at":"2026-11-13T10:18:02+00:00","first_seen_at":"2026-11-13T10:47:28+00:00","fetched_at":"2026-11-13T10:47:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126952:3852","url":null,"severity":null,"published_at":"2026-11-13T10:49:57+00:00","modified_at":"2026-11-13T10:49:57+00:00","first_seen_at":"2026-11-13T10:49:57+00:00","fetched_at":"2026-11-13T10:49:57+00:00","note":"Read GHSA-8g3f-425r-35rq and VulnCheck. Advisory header says Patched: None but text says fix is in v4.4.1; upgrade to v4.4.1 or later. Passkey default not stated. No PoC link, no exploitation reported."}],"documents":[{"id":145265,"url":"https://github.com/diced/zipline/security/advisories/GHSA-8g3f-425r-35rq","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-01-20T01:11:48+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145266,"url":"https://www.vulncheck.com/advisories/zipline-through-4.4.0-webauthn-authentication-bypass-via-passkey-login","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}