CVE-2026-30964: falha de média gravidade em web-auth webauthn-lib
Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.4epss 0.2%
web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowed_origins is configured, CheckAllowedOrigins reduces URL-like values to their host component and accepts on host match alone. This makes exact origin policies impossible to express: scheme and port differences are silently ignored. This vulnerability is fixed in 5.2.4.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Produtos afetados
web-auth · webauthn-frameworkweb-auth · webauthn-libweb-auth · webauthn-symfony-bundleCVEs relacionadas — web-auth webauthn-lib
No mesmo produto, das mais perigosas para as menos.