CVE-2021-38299: 
PHP vulnerability analysis and mitigation

A vulnerability was discovered in Webauthn Framework 3.3.x before 3.3.4 related to incorrect access control (CVE-2021-38299). The vulnerability allows an attacker with control over a user's system to login to a vulnerable service using an attached FIDO2 authenticator without passing a check of the user presence (NVD, FZI Report).

The vulnerability exists due to a missing verification check in the Webauthn Framework's authentication process. Specifically, the framework fails to properly validate the user presence check when using FIDO2 authenticators. This allows bypassing a critical security control that normally requires physical interaction with the authenticator device (NVD).

An attacker who has remote access to a system with an attached FIDO2 authenticator can authenticate to vulnerable services without requiring physical presence (i.e., without needing to physically press the authenticator's button). This bypasses a fundamental security control of FIDO2 authentication (FZI Report).

The vulnerability requires an attacker to have control over the user's system and access to an attached FIDO2 authenticator. While this limits the attack scope, it could be particularly dangerous in scenarios where an attacker has gained remote access to a system (NVD).

The vulnerability has been fixed in Webauthn Framework version 3.3.4. Organizations using affected versions should upgrade to version 3.3.4 or later to address this security issue (FZI Report).