{"action":"Upgrade web-auth/webauthn-framework to 5.3.1 or later.","affected":[{"fixed":"5.3.1","introduced":"5.3.0"}],"component":"web-auth/webauthn-framework","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":["5.3.1"],"ghsa_id":"GHSA-h4fw-6r7f-w494","id":"tcs_01M5KF3A5PCBQNWT2YQHHZJNCJ","modified_at":"2026-05-07T21:18:48.987495Z","published_at":"2026-05-07T21:05:33Z","references":["https://osv.dev/vulnerability/GHSA-h4fw-6r7f-w494","https://github.com/web-auth/webauthn-framework/security/advisories/GHSA-h4fw-6r7f-w494","https://github.com/web-auth/webauthn-framework"],"severity":{"label":"low","score":2.1},"sources":[{"source":"osv","source_id":"GHSA-h4fw-6r7f-w494","url":"https://osv.dev/vulnerability/GHSA-h4fw-6r7f-w494"}],"summary":"Webauthn has a User Verification Downgrade via Default-Open ClientOverridePolicy"}