Advisories for Composer/Web-Auth/Webauthn-Symfony-Bundle package

Webauthn\Bundle\Security\Http\Authenticator\WebauthnAuthenticator logs the full Symfony\Component\HttpFoundation\Request object inside the log context of both onAuthenticationSuccess() and onAuthenticationFailure() at INFO level: $this->logger->info('User has been authenticated successfully with Webauthn.', [ 'request' => $request, 'firewallName' => $firewallName, 'identifier' => $token->getUserIdentifier(), ]); $this->logger->info('Webauthn authentication request failed.', [ 'request' => $request, 'exception' => $exception, ]); Request::__toString() returns the raw HTTP message, including every request header. As soon as the configured logger normalises or stringifies the context (default …

When allowed_origins is configured, CheckAllowedOrigins reduces URL-like values to their host and accepts on host match. This makes exact origin policies impossible to express: scheme and port differences are lost for URL-like entries.