5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30964

CVE-2026-30964: Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation

Summary

When allowed_origins is configured, CheckAllowedOrigins reduces URL-like values to their host component and accepts on host match alone. This makes exact origin policies impossible to express: scheme and port differences are silently ignored.

Details

CheckAllowedOrigins stores each configured allowed origin as:

parse_url($allowedOrigin)['host'] ?? $allowedOrigin

and later reduces the received clientDataJSON.origin the same way:

parse_url($C->origin)['host'] ?? $C->origin

If the reduced value matches, the method returns early. As a result, for the normal allowed_origins path, the later HTTPS check is not reached.

This differs from WebAuthn Level 2, which requires verifying that C.origin matches the RP's origin (scheme + host + port), separately from verifying that authData.rpIdHash matches the expected RP ID.

Affected code:

CheckAllowedOrigins.php

Spec references:

PoC

Configuration:

webauthn:
  allowed_origins:
    - https://login.example.com:8443
  allow_subdomains: false

Send a registration or authentication response whose clientDataJSON.origin is:

Miggo Vulnerability Database

→

CVE-2026-30964

CVE-2026-30964:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
web-auth/webauthn-framework	composer	>= 5.2.0, < 5.2.4	5.2.4
web-auth/webauthn-lib	composer	>= 5.2.0, < 5.2.4	5.2.4
web-auth/webauthn-symfony-bundle	composer	>= 5.2.0, < 5.2.4	5.2.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-f7pm-6hr8-7ggm, is an origin validation bypass in the web-auth/webauthn-framework. The root cause lies in the Webauthn\CeremonyStep\CheckAllowedOrigins::process method. When validating the origin of a WebAuthn ceremony response, the code would extract only the hostname from both the client-provided origin and the configured allowed_origins. This was done using parse_url($origin, PHP_URL_HOST). As a result, the scheme (e.g., http vs https) and port number were ignored during the comparison. This flaw would allow an attacker to bypass origin restrictions by, for example, using an http scheme when https was required, or by using a different port on the same host. The patch fixes this by introducing a strict, full-origin comparison that includes the scheme, host, and port. The __construct method was also updated to pre-process the allowed_origins list to separate full origins from host-only entries, facilitating the new, more secure validation logic in the process method.

Vulnerable functions

Webauthn\CeremonyStep\CheckAllowedOrigins::process

src/webauthn/src/CeremonyStep/CheckAllowedOrigins.php

The `process` function was vulnerable because it performed origin validation by only comparing the host component of the client's origin against the `allowed_origins` list. It used `parse_url` to extract the host, effectively ignoring the scheme (e.g., 'http' vs 'https') and the port. This allowed an attacker to bypass the origin check if they could serve content from the same hostname but on a different port or with a different scheme, as both would be reduced to the same host value before comparison.

Webauthn\CeremonyStep\CheckAllowedOrigins::__construct

src/webauthn/src/CeremonyStep/CheckAllowedOrigins.php

The constructor was involved in the vulnerability by not pre-processing the `allowed_origins` list to distinguish between full origins (including scheme and port) and host-only origins. The original implementation stored the origins as provided, and the weak comparison logic was later applied in the `process` method. The patch rectifies this by parsing each allowed origin in the constructor and separating them into `fullOrigins` and `hostOrigins` to enable strict, full-origin validation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.