Skip to content

"android-key" cert chain validation needs to check that the chain's root cert is a known one before validating the chain #817

Open
Open
"android-key" cert chain validation needs to check that the chain's root cert is a known one before validating the chain#817
Milestone
v14.1.0

Description

@MasterKale
MasterKale
opened on Oct 14, 2026

Describe the issue

Too many people have submitted AI-assisted security vulnerability reports for the same issue: even with the improvements to X.509 certificate chain validation in v14.0.2, maliciously crafted "android-key" attestations can still induce malicious requests when CRL revocation checks happen because.

This is because Android Keystore attestation statements are supposed to include a full certificate chain to a known root certificate, but the check that the root certificate is a known one happens after the chain is verified, which includes CRL revocation checks.

The fix for this will be looking at the root certificate beforehand, ensuring it's an expected one, and then validating the certificate chain. Basically, swap these two checks around:

SimpleWebAuthn/packages/server/src/registration/verifications/verifyAttestationAndroidKey.ts

Lines 138 to 158 in 56697e7

/**
* Verify that x5c contains a full certificate path.
*/
const x5cNoRootPEM = x5c.slice(0, -1).map(convertCertBufferToPEM);
const x5cRootPEM = x5c.slice(-1).map(convertCertBufferToPEM);
try {
await validateCertificatePath(x5cNoRootPEM, x5cRootPEM);
} catch (err) {
const _err = err as Error;
throw new Error(`${_err.message} (Android Key)`, { cause: _err });
}
/**
* Make sure the root certificate is one of the Google Hardware Attestation Root certificates
*
* https://developer.android.com/privacy-and-security/security-key-attestation#root_certificate
*/
if (rootCertificates.length > 0 && rootCertificates.indexOf(x5cRootPEM[0]) < 0) {
throw new Error('x5c root certificate was not a known root certificate (Android Key)');
}

Reproduction Steps

  1. Unknown. I haven't yet tried to reproduce this on my Android tester. If someone sees this issue and can share a registration response with "android-key" attestation generated on webauthn.io I'd be grateful 🙏

Expected behavior

No fetch requests are made when verifying an "android-key" attestation statement and the root cert is not an expected one.

Code Samples + WebAuthn Options and Responses

N/A

Dependencies

  • OS: Android TBD
  • Browser: TBD
  • Authenticator: Google Password Manager probably

SimpleWebAuthn Libraries

@simplewebauthn/server@14.0.2

Additional context

N/A

Activity

  1. MasterKale
    added this to the v14.1.0 milestone on Oct 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions