CVE-2026-126952
HIGH
NVD
CVSS Score
8.1
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
Zipline through 4.4.0 contains an authentication bypass vulnerability in the WebAuthn login endpoint that creates sessions for a supplied registered credential ID without verifying the assertion. Attackers who obtain a target's passkey credential ID can impersonate that account without its authenticator, potentially gaining administrative control over SUPERADMIN accounts.