CVE-2026-30964

描述

### Summary When `allowed_origins` is configured, `CheckAllowedOrigins` reduces URL-like values to their `host` component and accepts on host match alone. This makes exact origin policies impossible to express: scheme and port differences are silently ignored. ### Details `CheckAllowedOrigins` stores each configured allowed origin as: ```php parse_url($allowedOrigin)['host'] ?? $allowedOrigin ``` and later reduces the received `clientDataJSON.origin` the same way: ```php parse_url($C->origin)['host'] ?? $C->origin ``` If the reduced value matches, the method returns early. As a result, for the normal `allowed_origins` path, the later HTTPS check is not reached. This differs from [WebAuthn Level 2](https://www.w3.org/TR/webauthn-2/), which requires verifying that `C.origin` matches the RP's origin (scheme + host + port), separately from verifying that `authData.rpIdHash` matches the expected RP ID. **Affected code:** - [CheckAllowedOrigins.php](https://github.com/web-auth/webauthn-framework/blob/d58906e/src/webauthn/src/CeremonyStep/CheckAllowedOrigins.php) **Spec references:** - [§7.1 Registering a New Credential](https://www.w3.org/TR/webauthn-2/#sctn-registering-a-new-credential) - [§7.2 Verifying an Authentication Assertion](https://www.w3.org/TR/webauthn-2/#sctn-verifying-assertion) - [CollectedClientData.origin](https://www.w3.org/TR/webauthn-2/#dom-collectedclientdata-origin) ### PoC Configuration: ```yaml webauthn: allowed_origins: - https://login.example.com:8443 allow_subdomains: false ``` Send a registration or authentication response whose `clientDataJSON.origin` is: ```text https://login.example.com:9443 ``` **Observed:** the response is accepted, because both values are reduced to `login.example.com`. **Expected:** the response should be rejected, because `https://login.example.com:8443` and `https://login.example.com:9443` are different origins. ### Impact This is an origin validation error (CWE-346) affecting deployments that use `allowed_origins`. The most practical browser-facing scenario is same-host / different-port origin confusion. In non-browser or custom clients, scheme confusion may also be relevant. ### Fix Fixed in version **5.2.4** by rewriting `CheckAllowedOrigins` to perform full origin comparison (scheme + host + port) as required by the WebAuthn spec: - Origins configured with a scheme (e.g. `https://example.com:8443`) are now stored and compared as full `scheme://host[:port]` values, with default port normalization (443 for HTTPS, 80 for HTTP). - Origins configured without a scheme are still matched by host only, for backward compatibility. - Subdomain matching now also verifies scheme and port consistency. See commit [b4cd9a43](https://github.com/web-auth/webauthn-framework/commit/b4cd9a43). ### Mitigation Upgrade to `web-auth/webauthn-framework` (or `web-auth/webauthn-lib` / `web-auth/webauthn-symfony-bundle`) **>= 5.2.4**.