GHSA-f7pm-6hr8-7ggm Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation

• Packagist web-auth/webauthn-framework: >= 5.2.0, < 5.2.4 → fixed in 5.2.4 • Packagist web-auth/webauthn-lib: >= 5.2.0, < 5.2.4 → fixed in 5.2.4 • Packagist web-auth/webauthn-symfony-bundle: >= 5.2.0, < 5.2.4 → fixed in 5.2.4

Summary When `allowed_origins` is configured, `CheckAllowedOrigins` reduces URL-like values to their `host` component and accepts on host match alone. This makes exact origin policies impossible to express: scheme and port differences are silently ignored. Details `CheckAllowedOrigins` stores each configured allowed origin as: ```php parse_url($allowedOrigin)['host'] ?? $allowedOrigin ``` and later reduces the received `clientDataJSON.origin` the same way: ```php parse_url($C->origin)['host'] ?? $C->origin ``` If the reduced value matches, the method returns early. As a result, for the normal `allowed_origins` path, the later HTTPS check is not reached. This differs from WebAuthn Level 2, which requires verifying that `C.origin` matches the RP's origin (scheme + host + port), separately from verifying that `authData.rpIdHash` matches the expected RP ID. Affected code: • CheckAllowedOrigins.php Spec references: • §7.1 Registering a New Credential • §7.2 Verifying an Authentication Assertion • CollectedClientData.origin PoC Configuration: ```yaml webauthn: allowed_origins: • https://login.example.com:8443 allow_subdomains: false ``` Send a registration or authentication response whose `clientDataJSON.origin` is: ```text https://login.example.com:9443 ``` Observed: the response is accepted, because both values are reduced to `login.example.com`. Expected: the response should be rejected, because `https://login.example.com:8443` and `https://login.example.com:9443` are different origins. Impact This is an origin validation error (CWE-346) affecting deployments that use `allowed_origins`. The most practical browser-facing scenario is same-host / different-port origin confusion. In non-browser or custom clients, scheme confusion may also be relevant. Fix Fixed in version 5.2.4 by rewriting `CheckAllowedOrigins` to perform full origin comparison (scheme + host + port) as required by the WebAuthn spec: • Origins configured with a scheme (e.g. `https://example.com:8443`) are now stored and compared as full `scheme://host[:port]` values, with default port normalization (443 for HTTPS, 80 for HTTP). • Origins configured without a scheme are still matched by host only, for backward compatibility. • Subdomain matching now also verifies scheme and port consistency. See commit b4cd9a43. Mitigation Upgrade to `web-auth/webauthn-framework` (or `web-auth/webauthn-lib` / `web-auth/webauthn-symfony-bundle`) >= 5.2.4.