CVE-2021-38299: 
PHP vulnerability analysis and mitigation

A vulnerability was discovered in Webauthn Framework 3.3.x before 3.3.4 related to incorrect access control (CVE-2021-38299). The vulnerability allows an attacker with control over a user's system to login to a vulnerable service using an attached FIDO2 authenticator without passing a check of the user presence (NVD, FZI Report).

The vulnerability exists due to a missing verification check in the Webauthn Framework's authentication process. Specifically, the framework fails to properly validate the user presence check when using FIDO2 authenticators. This allows bypassing a critical security control that normally requires physical interaction with the authenticator device (NVD).

An attacker who has remote access to a system with an attached FIDO2 authenticator can authenticate to vulnerable services without requiring physical presence (i.e., without needing to physically press the authenticator's button). This bypasses a fundamental security control of FIDO2 authentication (FZI Report).

The vulnerability has been fixed in Webauthn Framework version 3.3.4. Organizations using affected versions should upgrade to version 3.3.4 or later to address this security issue (FZI Report).