Executive brief
The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames
Affected products
- Packagist web-auth/webauthn-framework
- Packagist web-auth/webauthn-lib
Junglewise Threat Intelligence
CVE-2024-39912: The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames
CVE-2024-39912 · Severity: low · CVSS 3.1 · Published 2024-07-15
Technologies: web-auth/webauthn-framework (Packagist), web-auth/webauthn-lib (Packagist). Vendors: Packagist.
Related threats
- Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protectio
- Web-Auth Webauthn predictable fake credentials in SimpleFakeCredentialGenerator
- Webauthn has a User Verification Downgrade via Default-Open ClientOverridePolicy
- Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation
- Improper Access Control in Webauthn Framework