Insertion of Sensitive Information into Log File Affecting web-auth/webauthn-symfony-bundle package, versions <5.3.4
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Insertion of Sensitive Information into Log File vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PHP-WEBAUTHWEBAUTHNSYMFONYBUNDLE-17660505
- published27 Jun 2026
- disclosed26 Jun 2026
- creditUnknown
Introduced: 26 Jun 2026
CVE NOT AVAILABLE CWE-532 (opens in a new tab)How to fix?
Upgrade web-auth/webauthn-symfony-bundle to version 5.3.4 or higher.
Overview
web-auth/webauthn-symfony-bundle is a FIDO2/Webauthn Security Bundle For Symfony.
Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the onAuthenticationSuccess and onAuthenticationFailure processes. An attacker can obtain sensitive information by accessing logs that contain full HTTP request headers, including authentication credentials and session identifiers. This is particularly impactful in environments where logs are forwarded to centralized platforms with broader access than the application itself.
Workaround
This vulnerability can be mitigated by raising the minimum log level for the authenticator above INFO or configuring the log processor/formatter to strip the request key from the log context before writing.