Junglewise Threat Intelligence

CVE-2021-38299: Improper Access Control in Webauthn Framework

CVE-2021-38299 · Severity: low · CVSS 3.1 · Published 2021-09-29

Technologies: web-auth/webauthn-framework (Packagist). Vendors: Packagist.

Executive brief

Improper Access Control in Webauthn Framework

Affected products

Packagist web-auth/webauthn-framework

Related threats

Webauthn has a User Verification Downgrade via Default-Open ClientOverridePolicy
Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation
The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames