Skip to content
OpenAdvisories

Package · Packagist

web-auth/webauthn-framework

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Low 2.1
    GHSA-h4fw-6r7f-w494

    Webauthn has a User Verification Downgrade via Default-Open ClientOverridePolicy

    ## Summary In version 5.3.0 of the Symfony bundle, `Webauthn\Bundle\Policy\ClientOverridePolicy` defaulted to allowing all client overrides, including `userVerification`. A client could send `{"userVerification": "discouraged"}` in the assertion or attestatio…

    web-auth/webauthn-framework Packagist
  • Medium 5.4
    CVE-2026-30964

    Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation

    web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowed_origins is configured, CheckAllowedOrigins reduces URL-l…

    web-auth webauthn-framework webauthn-lib webauthn-symfony-bundle Wolfi Packagist
  • Medium 5.3
    CVE-2024-39912

    Enumeration of valid usernames in web-auth/webauthn-lib

    web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. The ProfileBasedRequestOptionsBuilder method returns allowedCredentials without any c…

    web-auth webauthn-framework web-auth/webauthn-framework web-auth/webauthn-lib Packagist
  • Critical 9.8
    CVE-2021-38299

    Improper Access Control in Webauthn Framework

    Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. An attacker that controls a user's system is able to login to a vulnerable service using an attached FIDO2 authenticator without passing a check of the user presence.

    web-auth/webauthn-framework Packagist