CVE-2026-30964 Details
Description
web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowed_origins is configured, CheckAllowedOrigins reduces URL-like values to their host component and accepts on host match alone. This makes exact origin policies impossible to express: scheme and port differences are silently ignored. This vulnerability is fixed in 5.2.4.
A vulnerability exists in the WebAuthn PHP libraries and Symfony bundle, specifically in versions prior to 5.2.4. When the 'allowed_origins' setting is used, the 'CheckAllowedOrigins' component improperly reduces URL-like origins to just their host names, ignoring crucial details like the scheme and port. This flaw creates confusion between origins that are technically different but appear the same when only the host is considered. The issue is particularly relevant in browser environments, where same-host but different-port origins can be mistakenly treated as identical.
Users can upgrade to WebAuthn Framework version 5.2.4 or later to address this vulnerability. Instructions for updating can be found in the WebAuthn Framework repository on GitHub.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-346 | Origin Validation Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| spomky-labs webauthn-lib | >= 5.2.0, < 5.2.4 |
CPE
Remediation
| |
| spomky-labs webauthn-symfony-bundle | >= 5.2.0, < 5.2.4 |
CPE
Remediation
| |
| spomky-labs webauthn framwork | >= 5.2.0, < 5.2.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | Initial Analysis | [email protected] |
| Mar 10, 2026 | New CVE Received | [email protected] |
| Mar 10, 2026 | CVE Modified | CISA-ADP |