Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. An attacker that controls a user's system is able to login to a vulnerable service using an attached FIDO2 authenticator without passing a check of the user presence.
CVE-2021-38299
CVSS base score
9.8 (v3.1)
Severity
CRITICAL
Attack vector
Network
Weakness
CWE-287
Last modified
November 5, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
spomky-labs webauthn framework
spomky-labs webauthn framwork
References
- github.com Release Notes, Third Party Advisory
- www.fzi.de Third Party Advisory
- github.com Release Notes, Third Party Advisory
- www.fzi.de Third Party Advisory