Executive brief
A vulnerability in the WebAuthn Symfony bundle causes sensitive login information to be recorded in system logs. This includes session cookies and authorization headers, which could allow anyone with access to the logs to hijack user sessions or steal credentials. This is particularly risky for organizations that use centralized logging platforms where access may be broader than the application itself.
Technical details
The WebauthnAuthenticator class in the web-auth/webauthn-symfony-bundle logs the entire Symfony Request object during authentication success and failure events at the INFO level. Because the Request object's string representation includes all raw HTTP headers, sensitive data such as 'Cookie' and 'Authorization' headers are written to the log stream in clear text. This occurs when loggers normalize or stringify the context, which is the default behavior for common formatters like LineFormatter and JsonFormatter. Attackers with access to log files or centralized logging platforms (e.g., ELK, Splunk) can use these leaked headers to perform session hijacking. The issue is fixed in version 5.3.4 by logging only non-sensitive request metadata.
Affected products
- web-auth webauthn-symfony-bundle < 5.3.4
Timeline
- 2026-05-24: disclosed
- 2026-05-24: advisory: Initial advisory published
- 2026-06-26: other: Advisory updated and reviewed