Skip to content
OpenAdvisories

Package · Packagist

web-auth/webauthn-framework

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 2.1
    GHSA-h4fw-6r7f-w494

    Webauthn has a User Verification Downgrade via Default-Open ClientOverridePolicy

    ## Summary In version 5.3.0 of the Symfony bundle, `Webauthn\Bundle\Policy\ClientOverridePolicy` defaulted to allowing all client overrides, including `userVerification`. A client could send `{"userVerification": "discouraged"}` in the assertion or attestatio…

    web-auth/webauthn-framework Packagist