~ / search / GHSA-6whf-q6p5-84wg

GHSA-6whf-q6p5-84wg

Improper Access Control in Webauthn Framework

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-38299

Packages

EcosystemPackageAffectedFixed in
Packagist web-auth/webauthn-framework >= 3.3.0, < 3.3.4 3.3.4

Details

As written in the advisory (Markdown source, shown as plain text).

Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. An attacker that controls a user's system is able to login to a vulnerable service using an attached FIDO2 authenticator without passing a check of the user presence.

References

External links from the advisory. They lead to third-party sites.