PT-2026-24193 · Unknown · Webauthn-Lib

Dorakemon · Published 2026-03-10 · Updated 2026-05-07 · CVE-2026-30964

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions web-auth/webauthn-lib versions prior to 5.2.4

Description The software’s origin validation process, when using the allowed origins configuration, reduces URL-like values to their host component, accepting matches based solely on the host. This prevents the implementation of exact origin policies, as scheme and port differences are ignored. Specifically, the CheckAllowedOrigins component uses parse url() to extract the host from both the configured allowed origins and the incoming clientDataJSON.origin. This reduction allows requests with differing schemes or ports to bypass the intended origin validation. This issue affects deployments utilizing the allowed origins setting and bypasses the exact-origin check required by WebAuthn standards. The vulnerable component is CheckAllowedOrigins.php. The vulnerable parameter is clientDataJSON.origin.

Recommendations Upgrade to version 5.2.4 or later to resolve this issue.

Exploit

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2026-30964

GHSA-F7PM-6HR8-7GGM

Affected Products

Webauthn-Lib

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30964.json · Exploit
• 🔥 https://github.com/web-auth/webauthn-framework/security/advisories/GHSA-f7pm-6hr8-7ggm · Exploit
• https://github.com/web-auth/webauthn-framework/commit/b4cd9a4394c35fcac6080fd2f84f4f58a30abc01 · Patch
• https://github.com/web-auth/webauthn-framework/commit/535cc3c2dcbd9c3dfd5e00a254ad4a984e5e7839 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-30964 · Security Note
• https://osv.dev/vulnerability/CVE-2026-30964 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f7pm-6hr8-7ggm · Vendor Advisory
• https://github.com/web-auth/webauthn-framework · Note
• https://twitter.com/CVEnew/status/2033361108405203367 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1rpx2ut/resumen_diario_de_vulnerabilidades_10032026 · Reddit Post
• https://t.me/cveNotify/162601 · Telegram Post