{"action":"Upgrade @simplewebauthn/server to 13.3.2 or later.","affected":[{"fixed":"13.3.2","introduced":"0"}],"component":"@simplewebauthn/server","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["13.3.2"],"ghsa_id":"GHSA-6hxq-p678-4hr2","id":"tcs_01M5KF78JPTXM4J9HZC9ZWWN4J","modified_at":"2026-09-04T17:45:04.701505094Z","published_at":"2026-09-04T17:33:20Z","references":["https://osv.dev/vulnerability/GHSA-6hxq-p678-4hr2","https://github.com/MasterKale/SimpleWebAuthn/security/advisories/GHSA-6hxq-p678-4hr2","https://github.com/MasterKale/SimpleWebAuthn/commit/67a41fed3dfd96cab1dcf414f6d1792a72e06e35","https://github.com/MasterKale/SimpleWebAuthn/commit/8a53d70f42bcbb7c744ef1b90e6db35bc4b26d06","https://github.com/MasterKale/SimpleWebAuthn/commit/dd0d73c716a528e6645efafbd43a972b64df71f9","https://github.com/MasterKale/SimpleWebAuthn","https://github.com/MasterKale/SimpleWebAuthn/releases/tag/v13.3.2"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-6hxq-p678-4hr2","url":"https://osv.dev/vulnerability/GHSA-6hxq-p678-4hr2"}],"summary":"SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor"}