Skip to content
OpenAdvisories

Package · Packagist

web-auth/webauthn-lib

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Low —
    GHSA-gq4g-fpc9-vjfq

    Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection

    ## Impact `Webauthn\SimpleFakeCredentialGenerator` is the library-provided default implementation of the `FakeCredentialGenerator` interface. It returns a stable list of decoy `PublicKeyCredentialDescriptor` objects for a given username so that an assertion r…

    web-auth/webauthn-lib Packagist
  • Medium 5.4
    CVE-2026-30964

    Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation

    web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowed_origins is configured, CheckAllowedOrigins reduces URL-l…

    web-auth webauthn-framework webauthn-lib webauthn-symfony-bundle Wolfi Packagist
  • Medium 5.3
    CVE-2024-39912

    Enumeration of valid usernames in web-auth/webauthn-lib

    web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. The ProfileBasedRequestOptionsBuilder method returns allowedCredentials without any c…

    web-auth webauthn-framework web-auth/webauthn-framework web-auth/webauthn-lib Packagist