https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T11:53:06.929455+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-275302 EUVD-2026-275302 2026-10-08T11:53:06.982740+00:00 EUVD-2026-275302 https://cve.radiocsirt.org/vuln/fkie_cve-2026-30964 fkie_cve-2026-30964 2026-10-08T11:53:06.982797+00:00

web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowed_origins is configured, CheckAllowedOrigins reduces URL-like values to their host component and accepts on host match alone. This makes exact origin policies impossible to express: scheme and port differences are silently ignored. This vulnerability is fixed in 5.2.4.

 https://cve.radiocsirt.org/vuln/ghsa-f7pm-6hr8-7ggm GHSA-f7pm-6hr8-7ggm — Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation 2026-10-08T11:53:06.982836+00:00

Affected: Packagist: web-auth/webauthn-framework, Packagist: web-auth/webauthn-lib, Packagist: web-auth/webauthn-symfony-bundle

### Summary When `allowed_origins` is configured, `CheckAllowedOrigins` reduces URL-like values to their `host` component and accepts on host match alone. This makes exact origin policies impossible to express: scheme and port differences are silently ignored.

### Details `CheckAllowedOrigins` stores each configured allowed origin as:

```php parse_url($allowedOrigin)['host'] ?? $allowedOrigin ```

and later reduces the received `clientDataJSON.origin` the same way:

```php parse_url($C->origin)['host'] ?? $C->origin ```

If the reduced value matches, the method returns early. As a result, for the normal `allowed_origins` path, the later HTTPS check is not reached.

This differs from [WebAuthn Level 2](https://www.w3.org/TR/webauthn-2/), which requires verifying that `C.origin` matches the RP's origin (scheme + host + port), separately from verifying that `authData.rpIdHash` matches the expected RP ID.

**Affected code:** - [CheckAllowedOrigins.php](https://github.com/web-auth/webauthn-framework/blob/d58906e/src/webauthn/src/CeremonyStep/CheckAllowedOrigins.php)

**Spec references:** - [§7.1 Registering a New Credential](https://www.w3.org/TR/webauthn-2/#sctn-registering-a-new-credential) - [§7.2 Verifying an Authentication Assertion](https://www.w3.org/TR/webauthn-2/#sctn-verifying-assertion) - [CollectedClientData.origin](https://www.w3.org/TR/webauthn-2/#dom-collectedclientdata-origin)

### PoC Configuration:

```yaml webauthn: allowed_origins: - https://login.exam…