The vulnerability is located in the capacitor-native-biometric plugin, where the onAuthenticationSucceeded() method does not enforce validation of the CryptoObject that it receives. Attackers can exploit this by hooking into the method through dynamic instrumentation, enabling them to bypass biometric authentication without possessing valid credentials. Because the method can be invoked by an attacker who is already able to execute code on the device, this bypass compromises the integrity of the authentication flow, potentially allowing unauthorized access to protected application data or functions.

Affected products include capacitor-native-biometric, with a known vulnerability in all releases prior to version 12.128.2. Users employing earlier versions of the plugin are at risk; no other vendors or products are identified as affected.

The low CVSS score reflects the limited reach of the flaw, but the potential impact on application credential integrity warrants attention, especially in high‑sensitivity environments.