Two Factor Web Authentication WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

0.1.6

Findings

1

Worst severity

high

Content hash

2ec6bce3340aaba459ca46ac… Copy

Findings

• high WebAuthn 2FA assertion replay — challenge never stored server-side, sign counter ignored

  auth_bypass

  Two_Factor_Webauthn::authentication_page() generates a 16-byte challenge via prepareAuthenticate() and sends it to the browser (wp_localize_script webauthnL10n.payload) but never persists it. The only leftover server flag, usermeta `_two_factor_webauthn_login`, is set to the literal 1 and is never read in validate_authentication(). On the way back, WebAuthn::validateAuthenticateInfo() treats the client-supplied originalChallenge as the expected challenge and only checks that it equals clientData.challenge — also client-supplied. Those two fields are not required to match the signed clientDataJSONarray that openssl_verify() actually covers, so the origin/type/challenge checks are theater. authenticate() then copies the 4-byte authenticator counter out of authenticatorData and never compares it to a stored signCount, so a cloned or replayed assertion is indistinguishable from a fresh one. Upstream davidearl/webauthn added pass-by-reference challenge storage and one-time clearing in December 2022 specifically 'to prevent a possible replay of a login'; this plugin's vendored copy never received that fix. Combined with stolen or phished primary credentials (the exact case 2FA exists for), one captured webauthn_response POST body logs the attacker in as the victim on every subsequent login, with no expiry. Registration (validateRegisterInfo) likewise never checks clientData, origin, or challenge, so a logged-in user can enroll a software-generated public key by POSTing a crafted attestationObject; that is secondary to the login replay.

  include/Davidearl/WebAuthn/WebAuthn.php:214-300

  Recommendation

  Store the challenge server-side (user meta or a single-use transient keyed to the Two Factor login nonce), bind it to the user id, and consume it on successful or failed authenticate() so it cannot be reused. Compare clientDataJSON bytes (the signed payload) to the parsed clientData used for origin/type/challenge checks. Require origin to be an exact allowlisted origin (scheme + host + port), not an unbounded host suffix. Persist authenticator signCount per credential and reject assertions whose counter is not greater than the stored value. Port the December 2022 davidearl/webauthn replay fix or replace the library with a maintained WebAuthn server (e.g. lbuchs/WebAuthn / web-auth/webauthn-lib) that implements the spec verification steps.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.