{"id":"CVE-2023-49208","details":"scheme/webauthn.c in Glewlwyd SSO server before 2.7.6 has a possible buffer overflow during FIDO2 credentials validation in webauthn registration.","modified":"2026-08-12T14:50:32.323948Z","published":"2023-11-23T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49208.json"},"references":[{"type":"WEB","url":"https://github.com/babelouest/glewlwyd/releases/tag/v2.7.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49208.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49208"},{"type":"FIX","url":"https://github.com/babelouest/glewlwyd/commit/f9d8c06aae8dfe17e761b18b577ff169e059e812"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/babelouest/glewlwyd","events":[{"introduced":"0"},{"fixed":"11f57ec345b2d12cdf777f694ff33a6a4f10361d"},{"fixed":"f9d8c06aae8dfe17e761b18b577ff169e059e812"}],"database_specific":{"cpe":"cpe:2.3:a:glewlwyd_sso_server_project:glewlwyd_sso_server:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"2.7.6"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v2.7.5","v2.7.4","v2.7.3","v2.7.2","v2.7.1","v2.7.0","v2.6.1","v2.6.0","v2.5.3","v2.5.2","v2.5.1","v2.5.0","v2.4.0","v2.3.2","v2.3.1","v2.3.0","v2.2.0","v2.1.1","v2.1.0","v2.0.0","v2.0.0-rc2","v2.0.0-rc1","v2.0.0-b3","v2.0.0-b2","v2.0.0-b1","v1.4.9","v1.4.3","v1.4.8","v1.4.7","v1.4.6","v1.4.4","v1.4.2","v1.4.1","v1.4.0","v1.3.3","v1.3.2","v1.3.1","v1.3","v1.2.4","v1.2.3","1.2.2","1.2.1","1.2","1.1.2","1.1.1","1.1","1.0.1","1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-49208.json","vanir_signatures_modified":"2026-08-12T14:50:32Z","vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["3126521908514980276993701937661429416","29460167690006000261515773344508394245","87246177665545369795529146646593038208","178857816088294456866092256009197415668","253239706193554113251102059820029890699","94868643169174739436906123308016492973","220479176731007184207716098956164154908","179946612665014277534457746097493345719","319460748058759492024994930827503141686","133578242049187467268492254494936622251"]},"id":"CVE-2023-49208-4a55c754","signature_type":"Line","signature_version":"v1","source":"https://github.com/babelouest/glewlwyd/commit/f9d8c06aae8dfe17e761b18b577ff169e059e812","target":{"file":"src/scheme/webauthn.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/babelouest/glewlwyd/commit/f9d8c06aae8dfe17e761b18b577ff169e059e812","target":{"file":"src/scheme/webauthn.c","function":"register_new_attestation"},"deprecated":false,"digest":{"function_hash":"37318830477182553963243962174868194257","length":18374},"id":"CVE-2023-49208-d01190f1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}