Medium

The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames

Disclosed: 15.07.2024
Updated: 11.10.2026 10:22

Summary

The ProfileBasedRequestOptionsBuilder method returns allowedCredentials without any credentials if no username was found.

Details

When WebAuthn is used as the first or only authentication method, an attacker can enumerate usernames based on the absence of the allowedCredentials property in the assertion options response. This allows enumeration of valid or invalid usernames.

Proposal how to resolve it:

php

return $this->publicKeyCredentialRequestOptionsFactory->create(
            $this->profile,
            count($allowedCredentials) <= 0 ? self::getRandomCredentials(): $allowedCredentials,
            $optionsRequest->userVerification,
            $extensions
);

private static function getRandomCredentials(): array
{
        $credentialSources = [];
        for ($i = 0; $i <= rand(0,1); $i++) {
            $credentialSources[] = new PublicKeyCredentialSource(
                random_bytes(32),
                "public-key",
                [],
                "basic",
                new EmptyTrustPath(),
                Uuid::v7(),
                random_bytes(77),
                Uuid::v7()->__toString(),
                rand(0, 6000),
                null
            );
        }
        return array_map(
            static fn (PublicKeyCredentialSource $credential): PublicKeyCredentialDescriptor => $credential->getPublicKeyCredentialDescriptor(),
            $credentialSources
        );
}

PoC

curl https://example.com/assertion/options
-H 'content-type: application/json'
--data-raw '{"username":"NotMeRandomUsername123"}'

Impact

By knowing which usernames are valid, attackers can focus their efforts on a smaller set of potential targets, increasing the efficiency and likelihood of successful attacks.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Composer package	web-auth/webauthn-framework	>= 4.5.0, < 4.9.0	4.9.0
Composer package	web-auth/webauthn-lib	>= 4.5.0, < 4.9.0	4.9.0

References

CVSS score 5.3/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness (CWE): CWE-204
Platform: Composer
Package: web-auth/webauthn-framework, web-auth/webauthn-lib
Disclosed: 15.07.2024
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-875x-g8p7-5w27 - CC BY 4.0

Vulnerability history: web-auth/webauthn-framework

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 4
First → latest: 09.2021 05.2026
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

Critical 1
Medium 2
Low 1

Disclosures per year

2021: 1
2022: 0
2023: 0
2024: 1
2025: 0
2026: 2

07.05.2026

Webauthn has a User Verification Downgrade via Default-Open ClientOverridePolicy

Low · 2.1 ghsa-h4fw-6r7f-w494 >= 5.3.0, < 5.3.1 5.3.1
10.03.2026

Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation

Medium · 5.4 CVE-2026-30964 >= 5.2.0, < 5.2.4 5.2.4
15.07.2024

The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames this entry

Medium · 5.3 CVE-2024-39912 >= 4.5.0, < 4.9.0 4.9.0
29.09.2021

Improper Access Control in Webauthn Framework

Critical · 9.8 CVE-2021-38299 >= 3.3.0, < 3.3.4 3.3.4

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application