Craft CMS versions including 5.10.3 and the current 5.x HEAD accept PublicKeyCredentialRequestOptions from unauthenticated login requests and do not persist the updated PublicKeyCredentialSource after WebAuthn assertion validation. Because the server does not update the credential counter, a captured passkey login request body can be replayed to create new authenticated sessions for the same user. This breaks WebAuthn's intended one-time challenge and signature-counter protections, reducing passkey assertions to replayable bearer tokens if the request body is exposed through logging, proxies, or compromised scripts.

An attacker who obtains a single successful passkey login request body can reuse it to gain unauthorized authenticated sessions for the victim's account. This effectively allows account/session takeover by replaying previously captured authentication data, undermining the security guarantees of WebAuthn passkey authentication in affected Craft CMS installations.

A patch is available for this vulnerability. Users should apply the official fix provided by Craft CMS to ensure that the updated credential counter is properly persisted after each WebAuthn assertion validation, preventing replay attacks. Until patched, avoid exposing passkey login request bodies in logs, proxies, or other channels that could be accessed by attackers.