web-auth/webauthn-framework Security Advisories | GitStock

low2026-07-07

Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection

GHSA-gq4g-fpc9-vjfq

medium2026-06-26

WebauthnAuthenticator leaks sensitive HTTP headers through INFO-level logs

GHSA-q683-8468-r6h6

low2026-05-07

Webauthn has a User Verification Downgrade via Default-Open ClientOverridePolicy

GHSA-h4fw-6r7f-w494

medium2026-03-10

Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation

GHSA-f7pm-6hr8-7ggm · CVE-2026-30964

medium2024-07-15

The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames

GHSA-875x-g8p7-5w27 · CVE-2024-39912