vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-30964

Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation

MEDIUM
5.4
CVSS Score
Published: March 10, 2026 at 05:16 PM UTC
Updated: June 17, 2026 at 10:33 AM UTC
6 products affected across 2 vendorsWebauthn FramworkWebauthn LibWebauthn Symfony Bundle

Using webauthn-framework by web-auth?

Get instant alerts when new vulnerabilities affect webauthn-framework - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM5.4
Exploit prediction
EPSS 0.2%
SSVC
PoC

Description

web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowed_origins is configured, CheckAllowedOrigins reduces URL-like values to their host component and accepts on host match alone. This makes exact origin policies impossible to express: scheme and port differences are silently ignored. This vulnerability is fixed in 5.2.4.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Webauthn Framwork· Spomky Labs
95%
5.2.0 ≤ v < 5.2.4
Webauthn Lib· Spomky Labs
95%
5.2.0 ≤ v < 5.2.4
Webauthn Symfony Bundle· Spomky Labs
95%
5.2.0 ≤ v < 5.2.4
WebAuthn Framework· Web Auth
60%
v < 5.2.4
Affected range stops below 5.2.4, so it looks safe — our inference, not a vendor statement
WebAuthn Lib· Web Auth
60%
v < 5.2.4
Affected range stops below 5.2.4, so it looks safe — our inference, not a vendor statement
WebAuthn Symfony Bundle· Web Auth
60%
v < 5.2.4
Affected range stops below 5.2.4, so it looks safe — our inference, not a vendor statement

References (3)

x_refsource_CONFIRMExploitVendor Advisory
Source: cverecord
https://github.com/web-auth/webauthn-framework/security/advisories/GHSA-f7pm-6hr8-7ggm
x_refsource_MISCPatch
Source: cverecord
https://github.com/web-auth/webauthn-framework/commit/535cc3c2dcbd9c3dfd5e00a254ad4a984e5e7839
x_refsource_MISCPatch
Source: cverecord
https://github.com/web-auth/webauthn-framework/commit/b4cd9a4394c35fcac6080fd2f84f4f58a30abc01

SSVC — Action Prioritization

SSVCPoCNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.4MEDIUMGitHub_M
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Vector?

Quick Info

StatusANALYZED
CWE
CWE-346

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card