What is GHSA-6rw4-h2xg-jvvp?

GHSA-6rw4-h2xg-jvvp is a security advisory published by GitHub Security Advisories with Critical severity. Zipline through 4.4.0 contains an authentication bypass vulnerability in the WebAuthn login...

Which CVE IDs does GHSA-6rw4-h2xg-jvvp cover?

GHSA-6rw4-h2xg-jvvp covers the following CVE IDs: CVE-2026-126952. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6rw4-h2xg-jvvp?

GHSA-6rw4-h2xg-jvvp has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

GHSA-6rw4-h2xg-jvvpCriticalCVSS 8.1

Zipline through 4.4.0 contains an authentication bypass vulnerability in the WebAuthn login...

Vendor

GitHub Security Advisories

Published

November 13, 2026

Last Modified

November 13, 2026

🔗 CVE IDs covered (1)

CVE-2026-126952 →

📋 Description

Zipline through 4.4.0 contains an authentication bypass vulnerability in the WebAuthn login endpoint that creates sessions for a supplied registered credential ID without verifying the assertion. Attackers who obtain a target's passkey credential ID can impersonate that account without its authenticator, potentially gaining administrative control over SUPERADMIN accounts.

🔗 References (4)

https://github.com/diced/zipline/security/advisories/GHSA-8g3f-425r-35rq
https://nvd.nist.gov/vuln/detail/CVE-2026-126952
https://www.vulncheck.com/advisories/zipline-through-4.4.0-webauthn-authentication-bypass-via-passkey-login
https://github.com/advisories/GHSA-6rw4-h2xg-jvvp