In VeridiumID before 3.5.0, the WebAuthn API allows an internal unauthenticated attacker (who can pass enrollment verifications and is allowed to enroll a FIDO key) to register their FIDO authenticator to a victim’s account and consequently take over the account.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Veridiumad | Veridiumid | * | 3.5.0 (excluding) |