The vulnerability arises from an incorrect check of a function's return value during the second‑factor authentication flow in Yubico webauthn-server-core. This flaw, a return‑value‑check failure (CWE‑253), enables an attacker to bypass the intended verification step and authenticate as a legitimate user, resulting in account impersonation and unauthorized access.

Yubico webauthn-server-core (java‑webauthn‑server) versions earlier than 2.8.2, specifically 2.8.0 through 2.8.1, are affected. The vulnerability applies to any deployment that uses these library versions in its authentication pipeline.

The CVSS score of 7.5 indicates a high impact potential. Although EPSS data is unavailable and the issue is not listed in CISA's KEV catalog, the nature of the flaw—allowing impersonation during the second‑factor step—means attackers could gain access to user accounts if they can supply a forged or modified second‑factor response. Successful exploitation would give full access to privileged resources controlled by the victim’s account.