CVEvulnerability

CVE-2026-56294

4.3 MEDIUM Published 2026-06-20 Modified 2026-10-08 Official page ↗
Status
Deferred
Published
2026-06-20
Last modified
2026-10-08
Assigner
[email protected]
CVSS 4.0 ([email protected])
4.3 MEDIUM — CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
4.8 MEDIUM — CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-287

Description

capacitor-native-biometric before 12.128.2 contains an authentication bypass vulnerability where the onAuthenticationSucceeded() method fails to validate CryptoObject parameters. Attackers can hook the onAuthenticationSucceeded() function using dynamic instrumentation to bypass biometric authentication without valid credentials.

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References