This vulnerability allows a webpage with an invalid TLS certificate, for which the user has granted an exception, to present a WebAuthn challenge that the user may be prompted to complete. This violates the WebAuthn specification that mandates challenges only be presented over secure transports without errors. The flaw was addressed and fixed in Firefox 140 and Thunderbird 140 releases. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

If exploited, an attacker controlling a webpage with an invalid TLS certificate could trick a user who has manually accepted the certificate exception into completing a WebAuthn challenge. This undermines the security guarantees of WebAuthn, potentially allowing unauthorized authentication actions. The impact is rated critical due to the high CVSS score and the violation of WebAuthn security requirements. However, no known exploits are reported in the wild.

This vulnerability is fixed in Mozilla Firefox 140 and Thunderbird 140. Users and administrators should update to these versions or later to remediate the issue. Since this is a client-side vulnerability, applying the official vendor updates is the recommended and effective mitigation. There is no indication from the vendor advisory that additional user actions or temporary mitigations are required.