EUVD-2026-275302

fkie_cve-2026-30964

web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowed_origins is configured, CheckAllowedOrigins reduces URL-like values to their host component and accepts on host match alone. This makes exact origin policies impossible to express: scheme and port differences are silently ignored. This vulnerability is fixed in 5.2.4.

GHSA-f7pm-6hr8-7ggm — Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation

Affected: Packagist: web-auth/webauthn-framework, Packagist: web-auth/webauthn-lib, Packagist: web-auth/webauthn-symfony-bundle

### Summary When `allowed_origins` is configured, `CheckAllowedOrigins` reduces URL-like values to their `host` component and accepts on host match alone. This makes exact origin policies impossible to express: scheme and port differences are silently ignored.

### Details `CheckAllowedOrigins` stores each configured allowed origin as:

```php parse_url($allowedOrigin)['host'] ?? $allowedOrigin ```

and later reduces the received `clientDataJSON.origin` the same way:

```php parse_url($C->origin)['host'] ?? $C->origin ```

If the reduced value matches, the method returns early. As a result, for the normal `allowed_origins` path, the later HTTPS check is not reached.

This differs from [WebAuthn Level 2](https://www.w3.org/TR/webauthn-2/), which requires verifying that `C.origin` matches the RP's origin (scheme + host + port), separately from verifying that `authData.rpIdHash` matches the expected RP ID.

**Affected code:** - [CheckAllowedOrigins.php](https://github.com/web-auth/webauthn-framework/blob/d58906e/src/webauthn/src/CeremonyStep/CheckAllowedOrigins.php)

**Spec references:** - [§7.1 Registering a New Credential](https://www.w3.org/TR/webauthn-2/#sctn-registering-a-new-credential) - [§7.2 Verifying an Authentication Assertion](https://www.w3.org/TR/webauthn-2/#sctn-verifying-assertion) - [CollectedClientData.origin](https://www.w3.org/TR/webauthn-2/#dom-collectedclientdata-origin)

### PoC Configuration:

```yaml webauthn: allowed_origins: - https://login.exam…

Most recent entries from all

EUVD-2026-275302

fkie_cve-2026-30964

GHSA-f7pm-6hr8-7ggm — Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation