-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| web-auth/webauthn-lib | composer | >= 4.5.0, < 4.9.0 | 4.9.0 |
| web-auth/webauthn-framework | composer | >= 4.5.0, < 4.9.0 | 4.9.0 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from ProfileBasedCreationOptionsBuilder's getFromRequest method returning empty excluded credentials when a username isn't found. This creates an observable difference in assertion options responses (presence/absence of allowedCredentials) that enables username enumeration. The commit diff shows the vulnerability was addressed by adding a 'hideExistingExcludedCredentials' parameter and conditional logic to return random credentials instead of empty ones. The pre-patch version in 4.5.0-4.8.x lacked this protection, making the original implementation of getFromRequest the vulnerable entry point that exposed credential existence through response discrepancies.
Ongoing coverage of React2Shell