Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-12225
CVE-2024-12225:
Quarkus vulnerability analysis and mitigation
Overview
A critical vulnerability (CVE-2024-12225) was discovered in the Quarkus security-webauthn module. The vulnerability was reported on May 6, 2025, and affects the WebAuthn functionality that handles user authentication. This security flaw exists in the default REST endpoints for user registration and login processes, which remain accessible even when custom endpoints are implemented (NVD, Red Hat CVE).
Technical details
The vulnerability stems from the Quarkus WebAuthn module's handling of REST endpoints. When developers implement custom endpoints for login and registration, the default endpoints remain accessible and partially functional. The issue is classified as an Authentication Bypass Using an Alternate Path (CWE-288). The vulnerability has received a CVSS v3.1 base score of 9.1 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating high severity with network accessibility and no required privileges or user interaction (NVD).
Impact
The vulnerability allows attackers to obtain a login cookie that either has no corresponding user in the Quarkus application or could correspond to an existing user unrelated to the attacker. This enables unauthorized access by allowing anyone to log in as an existing user by merely knowing the username. The SecurityIdentity obtained through this exploit typically has no roles by default, but depending on the application's implementation, it could gain additional privileges if the user exists in the system (Red Hat Bugzilla).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management