Description
web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowed_origins is configured, CheckAllowedOrigins reduces URL-like values to their host component and accepts on host match alone. This makes exact origin policies impossible to express: scheme and port differences are silently ignored. This vulnerability is fixed in 5.2.4.
Scores
CVSS v3
5.4
EPSS
0.0001
EPSS Percentile
0.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-346
Status
published
Products (3)
web-auth/webauthn-framework
< 5.2.4
web-auth/webauthn-lib
< 5.2.4
web-auth/webauthn-symfony-bundle
< 5.2.4
Published
Mar 10, 2026
Tracked Since
Mar 11, 2026