Skip to content

0.1.0: Updates to verifyChallenge

Latest
Latest
Compare
Choose a tag to compare
@TheRealNate TheRealNate released this 20 Jun 18:36
· 11 commits to master since this release
v0.1.0
8c087dd

This release contains security-related updates. All users should immediately update

Security Updates:
Previous versions contained an issue with verifyChallenge, where in certain situations a challenge solved for User A could be used in place of a challenge solved by User B. This issue could render MFA useless in applicable situations. This vulnerability does not apply to logging in.

This vulnerability applies to:

  • Reset Password
  • Use of MFA.verifyChallenge, where the userId returned by MFA.verifyChallenge is not validated to be the same as this.userId.

Breaking Changes:

  • MFA.verifyChallenge's arguments now take the format (userId, type, connectionHash, solvedChallenge)
Assets 2
Loading