{"action":"Upgrade web-auth/webauthn-lib to 5.3.5 or later.","affected":[{"fixed":"5.3.5","introduced":"4.9.0"}],"component":"web-auth/webauthn-lib","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":["5.3.5"],"ghsa_id":"GHSA-gq4g-fpc9-vjfq","id":"tcs_01M5KF306BH33KB3ZT65WF2S7G","modified_at":"2026-09-10T03:50:52.216595933Z","published_at":"2026-07-07T23:39:43Z","references":["https://osv.dev/vulnerability/GHSA-gq4g-fpc9-vjfq","https://github.com/web-auth/webauthn-framework/security/advisories/GHSA-gq4g-fpc9-vjfq","https://github.com/web-auth/webauthn-framework"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-gq4g-fpc9-vjfq","url":"https://osv.dev/vulnerability/GHSA-gq4g-fpc9-vjfq"}],"summary":"Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection"}