CVE-2021-38299: Spomky-Labs Webauthn Framwork

Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days.

Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. An attacker that controls a user's system is able to login to a vulnerable service using an attached FIDO2 authenticator without passing a check of the user presence.

Affected products

• Spomky-Labs Webauthn Framwork: before 3.2.9 (fixed in 3.2.9); from 3.3.0, before 3.3.4 (fixed in 3.3.4)

Published 2021-09-27. Last modified 2026-06-17.