CVE-2025-6433
📋 TL;DR
This vulnerability allows malicious websites with invalid TLS certificates to bypass WebAuthn security requirements and prompt users for authentication challenges. Attackers could trick users into authenticating with their security keys on compromised sites. Affects Firefox and Thunderbird users running versions before 140.
💻 Affected Systems
- Mozilla Firefox
- Mozilla Thunderbird
📦 What is this software?
Firefox by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal WebAuthn credentials and impersonate users on legitimate services, potentially gaining unauthorized access to sensitive accounts and systems.
Likely Case
Phishing campaigns could use this to harvest WebAuthn credentials from users who bypass TLS warnings, leading to account compromise.
If Mitigated
With proper TLS validation and user education about certificate warnings, exploitation requires user interaction and bypass of security warnings.
🎯 Exploit Status
Exploitation requires user interaction (bypassing TLS warnings) but is straightforward once user visits malicious site.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 140, Thunderbird 140
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2025-51/
Restart Required: Yes
Instructions:
1. Open Firefox/Thunderbird. 2. Click menu → Help → About Firefox/Thunderbird. 3. Allow automatic update to version 140 or higher. 4. Restart browser/email client.
🔧 Temporary Workarounds
Disable TLS certificate exception bypass
allConfigure browser to prevent users from bypassing TLS certificate warnings
about:config → security.certerror.hideAddException → true
Disable WebAuthn
allTemporarily disable WebAuthn authentication
about:config → security.webauth.webauthn → false
🧯 If You Can't Patch
- Educate users to never bypass TLS certificate warnings for untrusted websites
- Implement network filtering to block access to known malicious domains
🔍 How to Verify
Check if Vulnerable:
Check browser version in About Firefox/Thunderbird menu. If version is less than 140, system is vulnerable.Check Version:
firefox --version or thunderbird --versionVerify Fix Applied:
Verify version is 140 or higher in About Firefox/Thunderbird menu.📡 Detection & Monitoring
Log Indicators:
- WebAuthn authentication attempts from sites with invalid certificates
- User bypass of TLS certificate warnings
Network Indicators:
- TLS connections to domains with invalid certificates followed by WebAuthn traffic
SIEM Query:
source="browser_logs" AND (event="certificate_error_bypass" OR event="webauthn_challenge") AND dest_cert_valid="false"