GitHub Advisoryadvisory · Go
GHSA-89gr-r52h-f8rx golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed
CRITICAL
Official page ↗
- Aliases
- CVE-2026-39831
- Ecosystem
- Go
- Packages
- golang.org/x/crypto
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-862
- Reviewed
- 2026-06-25
Affected packages
• Go golang.org/x/crypto: < 0.52.0 → fixed in 0.52.0
Description
The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.
Related
Alias · CVE (1)
- CVE-2026-39831 The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User… vulnerability
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness