CVE-2021-38299

Critical

Description

Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. An attacker that controls a user's system is able to login to a vulnerable service using an attached FIDO2 authenticator without passing a check of the user presence.

SeverityCritical

CVSS9.8

Exploit probability—

ProductSpomky-labs Webauthn Framwork

PublishedSep 27, 2021

First seenSep 27, 2021

Weakness typeCWE-287Improper authentication

How to fix

Update

spomky-labs webauthn_framwork3.2.9, 3.3.4 or later
web-auth/webauthn-framework3.3.4 or later
spomky-labs webauthn_framework3.3.4 or later

Vendor advisories

github.com/web-auth/webauthn-framework/releases

Affected products

Product	Affected versions	Fixed in
spomky-labs webauthn_framwork	v < 3.2.9, 3.3.0 ≤ v < 3.3.4	3.2.9, 3.3.4
web-auth/webauthn-frameworkPackagist	3.3.0 ≤ v < 3.3.4	3.3.4
spomky-labs webauthn_framework	3.3.0 ≤ v < 3.3.4	3.3.4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.