{"id":"CVE-2021-38299","details":"Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. An attacker that controls a user's system is able to login to a vulnerable service using an attached FIDO2 authenticator without passing a check of the user presence.","aliases":["GHSA-6whf-q6p5-84wg"],"modified":"2026-11-07T10:47:14.297594053Z","published":"2021-09-27T06:15:07.910Z","database_specific":{"unresolved_ranges":[{"vendor_product":"spomky-labs:webauthn_framwork","cpes":["cpe:2.3:a:spomky-labs:webauthn_framwork:*:*:*:*:*:*:*:*"],"extracted_events":[{"source":"CPE_RANGE","range":[{"fixed":"3.2.9"}]}]}]},"references":[{"type":"ADVISORY","url":"https://github.com/web-auth/webauthn-framework/releases"},{"type":"ADVISORY","url":"https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2021-1-fehlende-ueberpruefung-von-user-presence-in-webauthn-framework/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/web-auth/webauthn-framework","events":[{"introduced":"b16d567e9a82a84cd7981872b67a58e45562f220"},{"fixed":"572e239c5702667ca52487faf861abc768a46308"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:a:spomky-labs:webauthn_framework:*:*:*:*:*:*:*:*","range":[{"introduced":"3.3.0"},{"fixed":"3.3.4"}],"source":"CPE_RANGE"}]}}],"versions":["v3.3.3","v3.3.2","v3.3.1","v3.3.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-38299.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}