CVE-2026-30964: Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation

March 10, 2026

When allowed_origins is configured, CheckAllowedOrigins reduces URL-like values to their host and accepts on host match. This makes exact origin policies impossible to express: scheme and port differences are lost for URL-like entries.

References

github.com/advisories/GHSA-f7pm-6hr8-7ggm
github.com/web-auth/webauthn-framework
github.com/web-auth/webauthn-framework/commit/535cc3c2dcbd9c3dfd5e00a254ad4a984e5e7839
github.com/web-auth/webauthn-framework/security/advisories/GHSA-f7pm-6hr8-7ggm
nvd.nist.gov/vuln/detail/CVE-2026-30964

Code Behaviors & Features

Detect and mitigate CVE-2026-30964 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →