Skip to content
OpenAdvisories

Vendor

web-auth

2 known vulnerabilities.

Products

webauthn-framework 2 webauthn-lib 1 webauthn-symfony-bundle 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-30964

    Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation

    web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowed_origins is configured, CheckAllowedOrigins reduces URL-l…

    web-auth webauthn-framework webauthn-lib webauthn-symfony-bundle Packagist
  • Medium 5.3
    CVE-2024-39912

    Enumeration of valid usernames in web-auth/webauthn-lib

    web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. The ProfileBasedRequestOptionsBuilder method returns allowedCredentials without any c…

    web-auth webauthn-framework web-auth/webauthn-framework web-auth/webauthn-lib Packagist