CVE-2026-30964
Medium · 5.4CVSS
5.4
EPSS
0.2%
Published
Mar 10, 2026
CISA due date
—
The record
web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowed_origins is configured, CheckAllowedOrigins reduces URL-like values to their host component and accepts on host match alone. This makes exact origin policies impossible to express: scheme and port differences are silently ignored. This vulnerability is fixed in 5.2.4.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | nextcloud-server-30 | 0 | 30.0.17-r2 |
| Chainguard | nextcloud-server-31 | 0 | 31.0.14-r2 |
| Chainguard | nextcloud-server-32 | 0 | 32.0.6-r3 |
| Chainguard | nextcloud-server-33 | 0 | 33.0.0-r1 |
| Wolfi | nextcloud-server-31 | 0 | 31.0.14-r2 |
| Wolfi | nextcloud-server-32 | 0 | 32.0.6-r3 |
| Wolfi | nextcloud-server-33 | 0 | 33.0.0-r1 |
Related vulnerabilities
- CVE-2025-66552 Nextcloud Server admin_audit does not log all actions on files in groupfolders Also affects nextcloud-server-30
- CVE-2025-66547 Nextcloud Server users can modify tags on files that do not belong to them Also affects nextcloud-server-30
- CVE-2026-24739 Symfony is a PHP framework for web and console applications and a set of reusable PHP… Also affects nextcloud-server-31
- CVE-2025-14761 Missing cryptographic key commitment in the AWS SDK for PHP may allow a user with write… Also affects nextcloud-server-31
- CVE-2025-64500 Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass Also affects nextcloud-server-31
- CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in… CWE-346
- CVE-2026-107230 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP… CWE-346
- CVE-2026-94485 Next.js is a React framework for building full-stack web applications. CWE-346