Description
web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowed_origins is configured, CheckAllowedOrigins reduces URL-like values to their host component and accepts on host match alone. This makes exact origin policies impossible to express: scheme and port differences are silently ignored. This vulnerability is fixed in 5.2.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| web-auth | webauthn-framework | < 5.2.4 | — |
| web-auth | webauthn-lib | < 5.2.4 | — |
| web-auth | webauthn-symfony-bundle | < 5.2.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | nextcloud-server-33 | 33.0.0-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | web-auth/webauthn-framework | >= 5.2.0, < 5.2.4 | 5.2.4 | GHSA-f7pm-6hr8-7ggm |
| Packagist | web-auth/webauthn-lib | >= 5.2.0, < 5.2.4 | 5.2.4 | GHSA-f7pm-6hr8-7ggm |
| Packagist | web-auth/webauthn-symfony-bundle | >= 5.2.0, < 5.2.4 | 5.2.4 | GHSA-f7pm-6hr8-7ggm |