Advisories for Composer/Web-Auth/Webauthn-Lib package

Webauthn\SimpleFakeCredentialGenerator is the library-provided default implementation of the FakeCredentialGenerator interface. It returns a stable list of decoy PublicKeyCredentialDescriptor objects for a given username so that an assertion request for an unknown user looks the same as a request for a real one, which mitigates username enumeration. The generator derives the whole decoy list from a single seed: $seed = hash('sha256', $username . $this->secret, true); When it is constructed without a …

When allowed_origins is configured, CheckAllowedOrigins reduces URL-like values to their host and accepts on host match. This makes exact origin policies impossible to express: scheme and port differences are lost for URL-like entries.

The ProfileBasedRequestOptionsBuilder method returns allowedCredentials without any credentials if no username was found.