CVE-2026-30964

Katalog CVE

CVSS 5.4 · Medium EPSS 0,20%

Kerentanan Origin Validation Error pada spomky-labs webauthn-lib, spomky-labs webauthn-symfony-bundle +1 lainnya. Skor CVSS 3.1 5.4 (Medium) menurut github.com.

Deskripsi (NVD)

web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowed_origins is configured, CheckAllowedOrigins reduces URL-like values to their host component and accepts on host match alone. This makes exact origin policies impossible to express: scheme and port differences are silently ignored. This vulnerability is fixed in 5.2.4.

Rincian

Terbit di NVD

10 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-346: Origin Validation Error

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 8,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/web-auth/webauthn-framework/security/advisories/GHSA-f7pm-6hr8-7ggm exploit · advisory vendor
• https://github.com/web-auth/webauthn-framework/commit/535cc3c2dcbd9c3dfd5e00a254ad4a984e5e7839 patch
• https://github.com/web-auth/webauthn-framework/commit/b4cd9a4394c35fcac6080fd2f84f4f58a30abc01 patch