A user verification downgrade vulnerability exists in version 5.3.0 of the Symfony Webauthn bundle. The default ClientOverridePolicy allowed clients to override server-configured user verification requirements, enabling a client to request 'userVerification: discouraged' and bypass user verification during authentication ceremonies. This flaw was patched in version 5.3.1. Earlier 5.x versions also allow user verification downgrades through a different code path, so upgrading to 5.3.1 or later is recommended. The vulnerability requires possession of the victim's authenticator and does not grant authentication by itself. Applications that check the user verification flag on authenticator data remain protected.