Packagist/web-auth/webauthn-lib: low
Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection
Action: Upgrade web-auth/webauthn-lib to 5.3.5 or later.
composer require web-auth/webauthn-lib:5.3.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.9.0 | 5.3.5 | - |
Fixed versions
| 5.3.5 |
Sources
- osv: GHSA-gq4g-fpc9-vjfq
- https://github.com/web-auth/webauthn-framework/security/advisories/GHSA-gq4g-fpc9-vjfq
- https://github.com/web-auth/webauthn-framework
published · modified · JSON