The vulnerability permits a webpage served over an invalid TLS connection to provide a WebAuthn challenge that the user can sign, which contravenes the WebAuthn specification that mandates a securely established transport. An attacker could therefore coerce a user into signing arbitrary data or authentication assertions, potentially enabling credential theft or unauthorized access. This isolation of a secure channel is a significant break in the web authentication model.

This flaw affects Mozilla Firefox and Mozilla Thunderbird versions prior to 140. Upgrades to Firefox 140+ or Thunderbird 140+ contain the fix. These products are the sole vendors identified, as listed in the CVE data.

With a CVSS score of 9.8 the vulnerability is high severity, but its EPSS score of less than 1% indicates a low probability of exploitation at present, and it is not listed in CISA KEV. The expected attack vector requires a user to accept an invalid certificate and then interact with a webpage that presents a WebAuthn challenge; an attacker performing a phishing campaign could exploit this, though significant user interaction is required. Protective measures are recommended to reduce risk until the patch is applied.