Advisories for Composer/Web-Auth/Webauthn-Framework package

When allowed_origins is configured, CheckAllowedOrigins reduces URL-like values to their host and accepts on host match. This makes exact origin policies impossible to express: scheme and port differences are lost for URL-like entries.

The ProfileBasedRequestOptionsBuilder method returns allowedCredentials without any credentials if no username was found.

Webauthn Framework has Incorrect Access Control. An attacker that controls a user's system is able to login to a vulnerable service using an attached FIDO2 authenticator without passing a check of the user presence.