CVE-2026-30964

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowed_origins is configured, CheckAllowedOrigins reduces URL-like values to their host component and accepts on host match alone. This makes exact origin policies impossible to express: scheme and port differences are silently ignored. This vulnerability is fixed in 5.2.4.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-346

Affected software

VendorProductVersions
web-authwebauthn-framework< 5.2.4
web-authwebauthn-lib< 5.2.4
web-authwebauthn-symfony-bundle< 5.2.4

References

Timeline

Published
Mar 10, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-309659.1Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.8 and 8.6.21, aCVE-2026-3096610.0Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.7 and 8.6.20, PCVE-2026-309678.8Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.9. and 8.6.22, CVE-2026-309689.8Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. PCVE-2026-309699.1Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. PCVE-2026-309709.1Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. PCVE-2026-309718.8ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolaCVE-2026-309727.5Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior o 9.5.2-alpha.10 and 8.6.23, PCVE-2026-309736.5Appium is an automation framework that provides WebDriver-based automation possibilities for a wide range platforms. Prior to 7.0.6, @appiumCVE-2026-309745.4Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaCVE-2026-309759.8Sonarr is a PVR for Usenet and BitTorrent users. Versions prior to 4.0.16.2942 have an authentication bypass that affected users that had diCVE-2026-309767.5Sonarr is a PVR for Usenet and BitTorrent users. In versions on the 4.x branch prior to 4.0.17.2950, an unauthenticated remote attacker can