GHSA-22w3-693w-x895
NoneCVSS
—
EPSS
—
Published
May 6, 2026
CISA due date
—
The record
webauthn-rs-core/webauthn-authenticator-rs: Origin validation mismatch possible when subdomains are allowed
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | webauthn-authenticator-rs | 0 | 0.5.5 |
| crates.io | webauthn-authenticator-rs | 0.6.0-dev | 0.6.1-dev |
| crates.io | webauthn-rs-core | 0 | 0.5.5 |
| crates.io | webauthn-rs-core | 0.6.0-dev | 0.6.1-dev |
Related vulnerabilities
- CVE-2026-106445 Handlebars provides the power necessary to let users build semantic templates. CWE-1289
- CVE-2026-89049 A server-side request forgery issue due to improper validation of equivalent address… CWE-1289
- CVE-2026-76977 SAP UI5 does not sufficiently validate the parent frame's origin against the configured… CWE-1289
- CVE-2026-74994 The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia… CWE-1289
- CVE-2026-19953 URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode… CWE-1289
- CVE-2026-60074 Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal… CWE-1289
- CVE-2026-42462 Fedify is a TypeScript library for building federated server apps powered by ActivityPub. CWE-1289
- GHSA-xrhx-7g5j-rcj5 Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 CWE-1289