THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-p845-629j-rcj6 (medium) — New API: Admin can reset passkeys for same-level or higher-privileged users

[GHSA] GHSA-p845-629j-rcj6 (medium) — New API: Admin can reset passkeys for same-level or higher-privileged users

highgithub_advisoriesPublished 2026-08-17

GHSA-p845-629j-rcj6 Severity: medium CVE: CVE-2026-64866

New API: Admin can reset passkeys for same-level or higher-privileged users

## Summary

The admin passkey reset endpoint lacked the role-level authorization check used by comparable privileged account-protection endpoints. A lower-privileged administrator could attempt passkey reset operations against same-level or higher-privileged users,

Indicators of compromise

0936e2504655a5cbf7bc3c388f6d3e2bb24916d3sha1
CVE-2026-64866cve

Original source: https://github.com/advisories/GHSA-p845-629j-rcj6