Security readout for executives and security teams
Plain-English summary
CVE-2021-38299 affects Webauthn Framework 3.3.x before 3.3.4. A compromised user machine could authenticate to a vulnerable service with an attached FIDO2 authenticator without the expected user-presence check. This weakens phishing-resistant MFA assumptions, but the source says the attacker must already control the user's system.
Executive priority
Treat this as a targeted MFA assurance issue. It is not documented as actively exploited, but services depending on vulnerable Webauthn Framework versions should be upgraded because the flaw can undermine expected user interaction during FIDO2 login.
Technical view
The issue is incorrect access control in Webauthn Framework 3.3.x before 3.3.4. The vulnerable flow fails to enforce user presence when using an attached FIDO2 authenticator, allowing login from a controlled user system. No CVSS, CWE, affected CPE, or broad product inventory is provided in the source bundle.
Likely exposure
Exposure is likely limited to applications or services that integrated Webauthn Framework 3.3.x before 3.3.4 for WebAuthn/FIDO2 authentication. The bundle does not identify specific downstream products, hosting models, or CPEs.
Exploitation context
The CVE source states an attacker controlling a user's system can log in using an attached FIDO2 authenticator without passing user presence. KEV is false, and the provided sources do not state active exploitation.
Researcher notes
Evidence is sparse: no CVSS, CWE, CPE, or exploit-status details are provided. The key technical boundary is the attacker precondition: control of the user's system plus access to an attached authenticator. Avoid generalizing this to all WebAuthn implementations.
Mitigation direction
- Identify services using Webauthn Framework 3.3.x.
- Upgrade Webauthn Framework to 3.3.4 or later.
- Review the FZI advisory and GitHub releases for vendor guidance.
- Prioritize systems relying on FIDO2 as a high-assurance control.
Validation and detection
- Inventory application dependencies for Webauthn Framework versions.
- Confirm deployed versions are not 3.3.x before 3.3.4.
- Review authentication code paths for enforced user presence checks.
- Check authentication logs for unusual FIDO2 logins from compromised endpoints.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-38299 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/web-auth/webauthn-framework/releasesCVE reference · x_refsource_MISC
- https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2021-1-fehlende-ueberpruefung-von-user-presence-in-webauthn-framework/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.