Threats affecting pkg:github/aliasvault/aliasvault

AliasVault browser extension versions prior to 0.29.4 have a vulnerability where passkey requests are not properly bound to the actual webpage origin or verified against the relying-party identifier. This allows a malicious website to forge these values and, with user approval, obtain a valid passkey assertion for a different site. Exploitation requires the extension to be installed, unlocked, configured as a passkey provider, and the victim to have a stored passkey for the impersonated site. The issue is fixed in version 0.29.4.