https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T11:22:29.891172+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-30964 CVE-2026-30964 — Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation 2026-10-08T11:22:29.906888+00:00

Affected: web-auth webauthn-framework, web-auth webauthn-lib, web-auth webauthn-symfony-bundle

web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowed_origins is configured, CheckAllowedOrigins reduces URL-like values to their host component and accepts on host match alone. This makes exact origin policies impossible to express: scheme and port differences are silently ignored. This vulnerability is fixed in 5.2.4.