Technical impact
The fault lies in the origin validation routine of the web-auth library. When allowed_origins is configured, the code trims any URL-like entry to its host component and verifies a match solely on that host. This behavior overlooks differences in scheme or port, enabling an attacker to supply a forged origin that matches the host but carries a manipulated scheme or port. The consequence is a literal bypass of origin checks, allowing an unauthenticated requester to masquerade as a legitimate origin and potentially obtain or tamper with Webauthn credentials. This flaw, classified as CWE‑346, directly undermines the authenticity guarantees that Webauthn purports to provide.
Affected Systems
Vulnerable products include the web-auth ecosystem: web-auth/webauthn-framework, web-auth/webauthn-lib, and web-auth/webauthn-symfony-bundle. All versions prior to 5.2.4 are affected. Versions 5.2.4 and later contain the remediation.
Risk and Exploitability
The CVSS score of 5.4 indicates a moderate impact, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to target a deployment that relies on exact origin checks for Webauthn authentication; by sending traffic with a crafted Origin header that matches only the host, the attacker can bypass the intended origin restriction. No additional privileges are required beyond the ability to make HTTP requests to the vulnerable application.
Github GHSA