{"id":"CVE-2026-30964","aliases":["EUVD-2026-10705","GHSA-f7pm-6hr8-7ggm"],"status":"published","title":"Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation","description":"web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowed_origins is configured, CheckAllowedOrigins reduces URL-like values to their host component and accepts on host match alone. This makes exact origin policies impossible to express: scheme and port differences are silently ignored. This vulnerability is fixed in 5.2.4.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00227,"percentile":0.13615,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-346"],"published":"2026-03-10T01:19:46Z","modified":"2026-11-07T10:47:32Z","fixes":[{"ecosystem":"Packagist","package":"web-auth/webauthn-framework","fixed_in":["5.2.4"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"web-auth/webauthn-lib","fixed_in":["5.2.4"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"web-auth/webauthn-symfony-bundle","fixed_in":["5.2.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"web-auth/webauthn-framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"5.2.4"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"web-auth/webauthn-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"5.2.4"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"web-auth/webauthn-symfony-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"5.2.4"}]}]},{"source":"osv","ecosystem":"Packagist","package":"web-auth/webauthn-framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"5.2.4"}]}],"versions":["5.2.0","5.2.1","5.2.2","5.2.3"]},{"source":"osv","ecosystem":"Packagist","package":"web-auth/webauthn-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"5.2.4"}]}],"versions":["5.2.0","5.2.1","5.2.2","5.2.3"]},{"source":"osv","ecosystem":"Packagist","package":"web-auth/webauthn-symfony-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"5.2.4"}]}],"versions":["5.2.0","5.2.1","5.2.2","5.2.3"]}],"products":[{"vendor":"spomky-labs","product":"webauthn-lib"},{"vendor":"spomky-labs","product":"webauthn-symfony-bundle"},{"vendor":"spomky-labs","product":"webauthn_framwork"},{"vendor":"web-auth","product":"webauthn-framework"},{"vendor":"web-auth","product":"webauthn-lib"},{"vendor":"web-auth","product":"webauthn-symfony-bundle"}],"references":[{"url":"https://github.com/web-auth/webauthn-framework/security/advisories/GHSA-f7pm-6hr8-7ggm","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/web-auth/webauthn-framework/commit/535cc3c2dcbd9c3dfd5e00a254ad4a984e5e7839","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/web-auth/webauthn-framework/commit/b4cd9a4394c35fcac6080fd2f84f4f58a30abc01","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30964","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f7pm-6hr8-7ggm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30964.json","tags":["advisory"]},{"url":"https://github.com/web-auth/webauthn-framework","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-30964","title":"Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation","description":"web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowed_origins is configured, CheckAllowedOrigins reduces URL-like values to their host component and accepts on host match alone. This makes exact origin policies impossible to express: scheme and port differences are silently ignored. This vulnerability is fixed in 5.2.4.","status":"published","published":"2026-03-10T17:16:46.895Z","modified":"2026-03-10T17:57:34.091Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T13:43:56.024247Z"}],"euvd":[{"id":"EUVD-2026-10705","description":"web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowed_origins is configured, CheckAllowedOrigins reduces URL-like values to their host component and accepts on host match alone. This makes exact origin policies impossible to express: scheme and port differences are silently ignored. This vulnerability is fixed in 5.2.4.","status":"published","published":"2026-03-10T17:16:46Z","modified":"2026-03-10T17:57:34Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:04.718931Z"}],"ghsa":[{"id":"GHSA-f7pm-6hr8-7ggm","title":"Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation","description":"### Summary\nWhen `allowed_origins` is configured, `CheckAllowedOrigins` reduces URL-like values to their `host` component and accepts on host match alone. This makes exact origin policies impossible to express: scheme and port differences are silently ignored.\n\n### Details\n`CheckAllowedOrigins` stores each configured allowed origin as:\n\n```php\nparse_url($allowedOrigin)['host'] ?? $allowedOrigin\n```\n\nand later reduces the received `clientDataJSON.origin` the same way:\n\n```php\nparse_url($C-\u003eorigin)['host'] ?? $C-\u003eorigin\n```\n\nIf the reduced value matches, the method returns early. As a result, for the normal `allowed_origins` path, the later HTTPS check is not reached.\n\nThis differs from [WebAuthn Level 2](https://www.w3.org/TR/webauthn-2/), which requires verifying that `C.origin` matches the RP's origin (scheme + host + port), separately from verifying that `authData.rpIdHash` matches the expected RP ID.\n\n**Affected code:**\n- [CheckAllowedOrigins.php](https://github.com/web-auth/webauthn-framework/blob/d58906e/src/webauthn/src/CeremonyStep/CheckAllowedOrigins.php)\n\n**Spec references:**\n- [§7.1 Registering a New Credential](https://www.w3.org/TR/webauthn-2/#sctn-registering-a-new-credential)\n- [§7.2 Verifying an Authentication Assertion](https://www.w3.org/TR/webauthn-2/#sctn-verifying-assertion)\n- [CollectedClientData.origin](https://www.w3.org/TR/webauthn-2/#dom-collectedclientdata-origin)\n\n### PoC\nConfiguration:\n\n```yaml\nwebauthn:\n  allowed_origins:\n    - https://login.example.com:8443\n  allow_subdomains: false\n```\n\nSend a registration or authentication response whose `clientDataJSON.origin` is:\n\n```text\nhttps://login.example.com:9443\n```\n\n**Observed:** the response is accepted, because both values are reduced to `login.example.com`.\n\n**Expected:** the response should be rejected, because `https://login.example.com:8443` and `https://login.example.com:9443` are different origins.\n\n### Impact\nThis is an origin validation error (CWE-346) affecting deployments that use `allowed_origins`. The most practical browser-facing scenario is same-host / different-port origin confusion. In non-browser or custom clients, scheme confusion may also be relevant.\n\n### Fix\nFixed in version **5.2.4** by rewriting `CheckAllowedOrigins` to perform full origin comparison (scheme + host + port) as required by the WebAuthn spec:\n\n- Origins configured with a scheme (e.g. `https://example.com:8443`) are now stored and compared as full `scheme://host[:port]` values, with default port normalization (443 for HTTPS, 80 for HTTP).\n- Origins configured without a scheme are still matched by host only, for backward compatibility.\n- Subdomain matching now also verifies scheme and port consistency.\n\nSee commit [b4cd9a43](https://github.com/web-auth/webauthn-framework/commit/b4cd9a43).\n\n### Mitigation\nUpgrade to `web-auth/webauthn-framework` (or `web-auth/webauthn-lib` / `web-auth/webauthn-symfony-bundle`) **\u003e= 5.2.4**.","status":"published","published":"2026-03-10T01:19:46Z","modified":"2026-03-10T22:21:16Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T14:39:33.538417Z"}],"nvd":[{"id":"CVE-2026-30964","description":"web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowed_origins is configured, CheckAllowedOrigins reduces URL-like values to their host component and accepts on host match alone. This makes exact origin policies impossible to express: scheme and port differences are silently ignored. This vulnerability is fixed in 5.2.4.","status":"published","published":"2026-03-10T18:18:55.41Z","modified":"2026-06-17T10:33:14.18Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T14:12:08.98071Z"}],"osv":[{"id":"CVE-2026-30964","title":"Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation","description":"web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowed_origins is configured, CheckAllowedOrigins reduces URL-like values to their host component and accepts on host match alone. This makes exact origin policies impossible to express: scheme and port differences are silently ignored. This vulnerability is fixed in 5.2.4.","status":"published","published":"2026-03-10T17:16:46.895Z","modified":"2026-11-07T10:47:32.120328429Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-346"],"updated_at":"2026-11-07T11:15:38.581573Z"},{"id":"GHSA-f7pm-6hr8-7ggm","title":"Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation","description":"### Summary\nWhen `allowed_origins` is configured, `CheckAllowedOrigins` reduces URL-like values to their `host` component and accepts on host match alone. This makes exact origin policies impossible to express: scheme and port differences are silently ignored.\n\n### Details\n`CheckAllowedOrigins` stores each configured allowed origin as:\n\n```php\nparse_url($allowedOrigin)['host'] ?? $allowedOrigin\n```\n\nand later reduces the received `clientDataJSON.origin` the same way:\n\n```php\nparse_url($C-\u003eorigin)['host'] ?? $C-\u003eorigin\n```\n\nIf the reduced value matches, the method returns early. As a result, for the normal `allowed_origins` path, the later HTTPS check is not reached.\n\nThis differs from [WebAuthn Level 2](https://www.w3.org/TR/webauthn-2/), which requires verifying that `C.origin` matches the RP's origin (scheme + host + port), separately from verifying that `authData.rpIdHash` matches the expected RP ID.\n\n**Affected code:**\n- [CheckAllowedOrigins.php](https://github.com/web-auth/webauthn-framework/blob/d58906e/src/webauthn/src/CeremonyStep/CheckAllowedOrigins.php)\n\n**Spec references:**\n- [§7.1 Registering a New Credential](https://www.w3.org/TR/webauthn-2/#sctn-registering-a-new-credential)\n- [§7.2 Verifying an Authentication Assertion](https://www.w3.org/TR/webauthn-2/#sctn-verifying-assertion)\n- [CollectedClientData.origin](https://www.w3.org/TR/webauthn-2/#dom-collectedclientdata-origin)\n\n### PoC\nConfiguration:\n\n```yaml\nwebauthn:\n  allowed_origins:\n    - https://login.example.com:8443\n  allow_subdomains: false\n```\n\nSend a registration or authentication response whose `clientDataJSON.origin` is:\n\n```text\nhttps://login.example.com:9443\n```\n\n**Observed:** the response is accepted, because both values are reduced to `login.example.com`.\n\n**Expected:** the response should be rejected, because `https://login.example.com:8443` and `https://login.example.com:9443` are different origins.\n\n### Impact\nThis is an origin validation error (CWE-346) affecting deployments that use `allowed_origins`. The most practical browser-facing scenario is same-host / different-port origin confusion. In non-browser or custom clients, scheme confusion may also be relevant.\n\n### Fix\nFixed in version **5.2.4** by rewriting `CheckAllowedOrigins` to perform full origin comparison (scheme + host + port) as required by the WebAuthn spec:\n\n- Origins configured with a scheme (e.g. `https://example.com:8443`) are now stored and compared as full `scheme://host[:port]` values, with default port normalization (443 for HTTPS, 80 for HTTP).\n- Origins configured without a scheme are still matched by host only, for backward compatibility.\n- Subdomain matching now also verifies scheme and port consistency.\n\nSee commit [b4cd9a43](https://github.com/web-auth/webauthn-framework/commit/b4cd9a43).\n\n### Mitigation\nUpgrade to `web-auth/webauthn-framework` (or `web-auth/webauthn-lib` / `web-auth/webauthn-symfony-bundle`) **\u003e= 5.2.4**.","status":"published","published":"2026-03-10T01:19:46Z","modified":"2026-09-10T03:50:38.931389778Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T15:46:46.006631Z"}]}}