CVE-2025-6433
published 2025-06-24CVE-2025-6433: If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the user would…
PriorityP345critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.24%
15.3th percentile
If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the user would be prompted to complete. This is in violation of the WebAuthN spec which requires "a secure transport established without errors". This vulnerability was fixed in Firefox 140 and Thunderbird 140.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | < firefox 140.0-1 (sid) | firefox 140.0-1 (sid) |
| mozilla | firefox | < 140.0 | 140.0 |
| mozilla | firefox | — | — |
| mozilla | thunderbird | >= 0 < 1:140.7.1+build1-0ubuntu0.22.04.1 | 1:140.7.1+build1-0ubuntu0.22.04.1 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-7f3m-mqm5-5x2c: If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the u
ghsa_unreviewed·2025-06-26
CVE-2025-6433 [CRITICAL] CWE-295 GHSA-7f3m-mqm5-5x2c: If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the u
If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the user would be prompted to complete. This is in violation of the WebAuthN spec which requires "a secure transport established without errors". This vulnerability affects Firefox < 140.
OSV
CVE-2025-6433: If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the u
osv·2025-06-24·CVSS 9.8
CVE-2025-6433 [CRITICAL] CVE-2025-6433: If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the u
If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the user would be prompted to complete. This is in violation of the WebAuthN spec which requires "a secure transport established without errors". This vulnerability affects Firefox < 140 and Thunderbird < 140.
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2026-02-02
CVE-2025-8031 Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context,
an attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, bypass security restrictions, cross-site
tracing, or execute arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
firefox: WebAuthn would allow a user to sign a challenge on a webpage with an invalid TLS certificate
vendor_redhat·2025-06-24·CVSS 9.8
CVE-2025-6433 [CRITICAL] firefox: WebAuthn would allow a user to sign a challenge on a webpage with an invalid TLS certificate
firefox: WebAuthn would allow a user to sign a challenge on a webpage with an invalid TLS certificate
If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the user would be prompted to complete. This is in violation of the WebAuthN spec which requires "a secure transport established without errors". This vulnerability affects Firefox < 140 and Thunderbird < 140.
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue:
If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the user would be prompted to complete. This is in violation of the WebAuthN spec which requi
Debian
CVE-2025-6433: firefox - If a user visited a webpage with an invalid TLS certificate, and granted an exce...
vendor_debian·2025·CVSS 9.8
CVE-2025-6433 [CRITICAL] CVE-2025-6433: firefox - If a user visited a webpage with an invalid TLS certificate, and granted an exce...
If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the user would be prompted to complete. This is in violation of the WebAuthN spec which requires "a secure transport established without errors". This vulnerability affects Firefox < 140 and Thunderbird < 140.
Scope: local
sid: resolved (fixed in 140.0-1)
Mozilla
Mozilla Foundation Security Advisory 2025-54: CVE-2025-6433
vendor_mozilla·CVSS 9.8
CVE-2025-6433 [CRITICAL] Mozilla Foundation Security Advisory 2025-54: CVE-2025-6433
Mozilla Foundation Security Advisory 2025-54
CVE: CVE-2025-6433
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 140
Mozilla
Mozilla Foundation Security Advisory 2025-51: CVE-2025-6433
vendor_mozilla·CVSS 9.8
CVE-2025-6433 [CRITICAL] Mozilla Foundation Security Advisory 2025-51: CVE-2025-6433
Mozilla Foundation Security Advisory 2025-51
CVE: CVE-2025-6433
Product: Firefox
Impact: high
Fixed in: Firefox 140
No detection rules found.
No public exploits indexed.
2025-06-24
Published