PT-2026-41603

Summary In version 5.3.0 of the Symfony bundle, WebauthnBundlePolicyClientOverridePolicy defaulted to allowing all client overrides, including userVerification. A client could send "userVerification": "discouraged" in the assertion or attestation options request to override a server-configured...