# StrongKey FIDO Server credential-type confusion, passkey bypass

Source: https://startwithidentity.com/cves/cve-2025-26788/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

## What broke

StrongKey FIDO Server (4.10.0 through 4.15.0) mixed up discoverable and non-discoverable credentials. The server would accept an assertion for the wrong credential type and authenticate the attacker as the victim. High. StrongKey patched.

## Why it matters

On-prem [FIDO2](https://startwithidentity.com/glossary/fido2/) servers are how regulated environments get passkeys without sending every ceremony to a cloud IdP. A credential-type confusion is a passkey auth bypass with no phishing required. It is the server-side cousin of [CVE-2026-34348](https://startwithidentity.com/cves/cve-2026-34348/) (logging) and of Keycloak's `fmt:none` attestation-policy bypass.

## What to do

- Upgrade StrongKey FIDO Server off the 4.10-4.15 line.
- Confirm your FIDO server still distinguishes resident / discoverable keys from server-side credentials after the upgrade.
- Review authentication logs for ceremonies that succeeded with an unexpected credential type.

## After you patch

Flaws in the phishing-resistant layer are serious precisely because the resulting authentication satisfies your strongest policy.

- **Hunt for authentications with an empty device ID** or with no matching interactive session on the originating host, accepting that some legitimate traffic looks similar.
- **Review registered authenticators and devices** for enrolments you did not expect, which is the persistence step in this class.
- **Re-enrol credentials for privileged accounts** if assertion material may have been exposed, and prefer device-bound hardware authenticators for those users.
- **Verify server-side [user verification](https://startwithidentity.com/glossary/phishing-resistant-mfa/) checks**, since accepting an assertion with the flag unset removes the property you deployed passkeys for. See [WebAuthn and FIDO2](https://startwithidentity.com/standards/webauthn-fido2/).

## Sources

- [NVD: CVE-2025-26788](https://nvd.nist.gov/vuln/detail/CVE-2025-26788)