Cloudanix VulnDB

GHSA-h4fw-6r7f-w494

Low · 2.1

Webauthn has a User Verification Downgrade via Default-Open ClientOverridePolicy

CVSS

2.1

EPSS

—

Published

May 7, 2026

CISA due date

—

The record

In version 5.3.0 of the Symfony bundle, `Webauthn\Bundle\Policy\ClientOverridePolicy` defaulted to allowing all client overrides, including `userVerification`. A client could send `{"userVerification": "discouraged"}` in the assertion or attestation options request to override a server-configured `userVerification: required`, causing the emitted WebAuthn options to instruct the authenticator to skip user verification. The `CheckUserVerification` ceremony step then read the same downgraded options and skipped its check.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities