porro
Start free trial
Product
Needs attention Checks Setup Updates Alerts Tour the product →
Connectors
Laravel Filament Statamic Craft CMS JavaScript One-click install WordPress · soon All connectors →
Security Pricing

Free tools and reference

Lock-file checker Advisories End of life Blog Log in

Advisories  /  composer  /  web-auth

composer

web-auth/webauthn-lib

Security advisories for web-auth/webauthn-lib, newest first. 3 known, all fixed. If you’re on 5.3.5 or later, none of them affect you.

RSS feed Check your lock file →

Latest version

5.3.9

Advisories

3 · 0 unfixed

Last advisory

7 Jul 2026

Safe from

5.3.5

3 advisories · newest first

LOW 7 Jul 2026

Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection

GHSA-gq4g-fpc9-vjfq

Affected

≥ 4.9.0, < 5.3.5

Fixed in

5.3.5
MODERATE5.4 10 Mar 2026

Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation

GHSA-f7pm-6hr8-7ggm · CVE-2026-30964

Affected

≥ 5.2.0, < 5.2.4

Fixed in

5.2.4
MODERATE5.3 15 Jul 2024

The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames

GHSA-875x-g8p7-5w27 · CVE-2024-39912

Affected

≥ 4.5.0, < 4.9.0

Fixed in

4.9.0
/advisories/composer/web-auth/webauthn-lib/feed.rss

From Packagist and the GitHub advisory database · synced hourly

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →