Information Exposure Affecting web-auth/webauthn-lib package, versions >=4.9.0, <5.3.5
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-WEBAUTHWEBAUTHNLIB-17893194
- published8 Jul 2026
- disclosed7 Jul 2026
- creditUnknown
Introduced: 7 Jul 2026
CVE NOT AVAILABLE CWE-204 (opens in a new tab)How to fix?
Upgrade web-auth/webauthn-lib to version 5.3.5 or higher.
Overview
Affected versions of this package are vulnerable to Information Exposure via the SimpleFakeCredentialGenerator constructor in src/webauthn/src/SimpleFakeCredentialGenerator.php. An attacker can defeat username-enumeration protection by supplying a username and comparing the server’s decoy credential list against the list they recompute locally when the generator is instantiated without a secret. With the default empty secret, the fake credential seed depends only on the username, so the returned PublicKeyCredentialDescriptor list is reproducible byte-for-byte from public input alone. That lets an unauthenticated requester distinguish fake responses from real ones and infer whether an account exists.