NetApp ONTAP WebAuthn multi-factor authentication (Relying Party ID): An attacker who already has valid credentials

Impact

An attacker who already has valid credentials sidesteps the WebAuthn second factor because the Relying Party ID is not bound correctly. The hardware-key requirement protecting storage admin logins stops being a barrier.

Who can reach it

A remote attacker in possession of valid ONTAP credentials, against a system running 9.16.1 or later with WebAuthn MFA configured.

What to do

Upgrade to the ONTAP release NetApp names in the advisory. Until then, do not count WebAuthn as the control that stops credential reuse - rotate any password suspected of exposure rather than relying on the second factor.

References