GitHub Advisoryadvisory · Packagist

GHSA-6whf-q6p5-84wg Improper Access Control in Webauthn Framework

CRITICAL Published 2021-09-29 Modified 2021-10-06 Official page ↗
Aliases
CVE-2021-38299
Ecosystem
Packagist
Packages
web-auth/webauthn-framework
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-863
Reviewed
2021-09-28

Affected packages

• Packagist web-auth/webauthn-framework: >= 3.3.0, < 3.3.4 → fixed in 3.3.4

Description

Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. An attacker that controls a user's system is able to login to a vulnerable service using an attached FIDO2 authenticator without passing a check of the user presence.

Related

Alias · CVE (1)

  • CVE-2021-38299 Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References