p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in web-auth/webauthn-framework

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für web-auth/webauthn-framework: 0. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 4

  1. GHSA-h4fw-6r7f-w494

    Niedrig · CVSS 2.1Korrektur verfügbar

    Webauthn has a User Verification Downgrade via Default-Open ClientOverridePolicy

    ## Summary In version 5.3.0 of the Symfony bundle, `Webauthn\Bundle\Policy\ClientOverridePolicy` defaulted to allowing all client overrides, including `userVerification`. A client could send `{"userVerification": "discouraged"}` in the assertion or attestation options request to override a server-configured `userVerification: required`, causing the emitted WebAuthn options to instruct the authenticator to skip user verification. The `CheckUserVerification` ceremony step then read the same downgraded options and skipped its check. ## Affected versions - **Vulnerable**: 5.3.0 - **Patched**: 5.3.1 5.3.0 was released on 2026-05-01 and 5.3.1 w

    web-auth/webauthn-frameworkPHP
    • Auf 5.3.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2026-30964

    Mittel · CVSS 5.4EPSS 0,21%Korrektur verfügbar

    Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation

    web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowed_origins is configured, CheckAllowedOrigins reduces URL-like values to their host component and accepts on host match alone. This makes exact origin policies impossible to express: scheme and port differences are silently ignored. This vulnerability is fixed in 5.2.4.

    web-auth/webauthn-frameworkPHP
    • Auf 5.2.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2024-39912

    Mittel · CVSS 5.3EPSS 0,39%Korrektur verfügbar

    Enumeration of valid usernames in web-auth/webauthn-lib

    web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. The ProfileBasedRequestOptionsBuilder method returns allowedCredentials without any credentials if no username was found. When WebAuthn is used as the first or only authentication method, an attacker can enumerate usernames based on the absence of the `allowedCredentials` property in the assertion options response. This allows enumeration of valid or invalid usernames. By knowing which usernames are valid, attackers can focus their efforts on a smaller set of potential ta

    web-auth/webauthn-frameworkPHP
    • Auf 4.9.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →