Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/web-auth/webauthn-lib@3.1.1
purl pkg:composer/web-auth/webauthn-lib@3.1.1
Next non-vulnerable version 5.2.4
Latest non-vulnerable version 5.2.4
Risk 3.1
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-gnyd-g7p6-aydy
Aliases:
CVE-2026-30964
GHSA-f7pm-6hr8-7ggm
web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowed_origins is configured, CheckAllowedOrigins reduces URL-like values to their host component and accepts on host match alone. This makes exact origin policies impossible to express: scheme and port differences are silently ignored. This vulnerability is fixed in 5.2.4.
5.2.4
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-12T21:20:17.981167+00:00 GitLab Importer Affected by VCID-gnyd-g7p6-aydy https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/web-auth/webauthn-lib/CVE-2026-30964.yml 38.6.0