{"id":"GHSA-22w3-693w-x895","revision":null,"records":[{"revision":"5a9efe965c7e4a10b38e1af9ca56caf8","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-22w3-693w-x895","aliases":[],"title":"webauthn-rs-core/webauthn-authenticator-rs: Origin validation mismatch possible when subdomains are allowed","description":"### Summary\n\n`webauthn-rs-core` ([Relying Party][rp]) and `webauthn-authenticator-rs` ([client][]) checked that [an `Origin` in `CollectedClientData`][origin] is valid for [an RP ID][rpid] with [`str::ends_with()`][ends-with], [without checking for a dot (`.`) before the RP ID when allowing subdomains][registerable-suffix].\n\nThis check is flawed, and could allow requests from an attacker-controlled domain such as `hermit-crab.example` to be accepted for the RP ID `crab.example` (assuming `.example` was publicly-registerable TLD) when the RP allows authenticating from a subdomain (disabled by default in `webauthn-rs-core` and `webauthn-rs`).\n\n[registerable-suffix]: https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to\n[ends-with]: https://doc.rust-lang.org/stable/std/primitive.str.html#method.ends_with\n[client]: https://www.w3.org/TR/webauthn-3/#client\n[rp]: https://www.w3.org/TR/webauthn-3/#relying-party\n[rpid]: https://www.w3.org/TR/webauthn-3/#rp-id\n[origin]: https://www.w3.org/TR/webauthn-3/#dom-collectedclientdata-origin\n\n* In `webauthn-rs-core`, this **only** applies when:\n  * [`WebauthnCore::allow_subdomains_origin`](https://docs.rs/webauthn-rs-core/0.5.4/webauthn_rs_core/struct.WebauthnCore.html#method.new_unsafe_experts_only) is `true` (the default is `false`), *and*\n  * the attacker could register a domain that ends with the RP ID as a raw string, *and*,\n  * the client does not implement these checks correctly either\n\n  `webauthn-rs` can set `allow_subdomains_origin` via [`WebauthnBuilder::allow_subdomains`](https://docs.rs/webauthn-rs/0.5.4/webauthn_rs/struct.WebauthnBuilder.html#method.allow_subdomains). Fixing the bug in `webauthn-rs-core` also fixes it in `webauthn-rs`.\n\n* In `webauthn-authenticator-rs`, the flawed check is in [`WebauthnAuthenticator::do_registration()`](https://docs.rs/webauthn-authenticator-rs/0.5.4/webauthn_authenticator_rs/struct.WebauthnAuthenticator.html#method.do_registration) and [`do_authentication()`](https://docs.rs/webauthn-authenticator-rs/0.5.4/webauthn_authenticator_rs/struct.WebauthnAuthenticator.html#method.do_registration). \n\n  A conforming [Relying Party][rp] implementation would reject such requests, but `webauthn-rs-core` did not.\n\n  An application can still provide an incorrect `origin` parameter to `webauthn-authenticator-rs`, or use lower-level APIs that bypass these checks entirely, and this is by design.\n\nThese issues are a violation of [WebAuthn Level 3 §13.4.9](https://www.w3.org/TR/webauthn-3/#sctn-validating-origin), [§5.1.3 Step 8](https://www.w3.org/TR/webauthn-3/#CreateCred-DetermineRpId) and [§5.1.4.1 Step 7](https://www.w3.org/TR/webauthn-3/#GetAssn-DetermineRpId).\n\n### Details\n\n* `webauthn-rs-core/src/core.rs` line 1213:\n\n  https://github.com/kanidm/webauthn-rs/blob/197cddf8487a2dbdd5d374e50d80aa1e4682f3ab/webauthn-rs-core/src/core.rs#L1211-L1216\n\n* `webauthn-authenticator-rs/src/lib.rs` line 274:\n\n  https://github.com/kanidm/webauthn-rs/blob/197cddf8487a2dbdd5d374e50d80aa1e4682f3ab/webauthn-authenticator-rs/src/lib.rs#L274-L277\n\n* `webauthn-authenticator-rs/src/lib.rs` line 335:\n\n  https://github.com/kanidm/webauthn-rs/blob/197cddf8487a2dbdd5d374e50d80aa1e4682f3ab/webauthn-authenticator-rs/src/lib.rs#L335-L338\n\n[`str::ends_with()`][ends-with] performs a raw string suffix match _without_ [enforcing a domain label boundary][registerable-suffix]:\n\nOrigin | RP ID | Expected result | Result with incorrect `ends_with` check\n-- | -- | -- | --\n`hermit-crab.example` | `crab.example` | rejected | accepted **(bug!)**\n`auth.crab.example` | `crab.example` | accepted | accepted (subdomain)\n`crab.example` | `crab.example` | accepted | accepted (exact match)\n`hermit-crab.example` | `auth.crab.example` | rejected | rejected\n`auth.crab.example` | `auth.crab.example` | accepted | accepted (exact match)\n\n### Fix\n\nWhen `webauthn-rs-core` v0.5.5 checks if an `Origin` is a valid subdomain of an RP ID, it will check that it ends with the RP ID prefixed with a dot (`.{rp_id}`). `webauthn-rs` v0.5.5 will be fixed by depending on `webauthn-rs-core` v0.5.5.\n\n`webauthn-authenticator-rs` v0.5.5 now uses `webauthn-rs-core`'s checks in `WebauthnAuthenticator`.\n\nRegression tests for this bug have been added to both libraries.\n\n### Impact\n\nWith a **both** a non-conforming [client][] implementation and vulnerable version of `webauthn-rs-core` configured to allow subdomains (not the default), this bug would allow an attacker at `hermit-crab.example` to phish a target's credential for the RP ID `crab.example` by directly proxying a legitimate `navigator.credentials.get()` request on the attacker's domain.\n\nHowever, _conforming_ [client implementations][client] (ie: all web browsers) will refuse to process WebAuthn requests for an RP ID that does not match the `Origin` of the current page and is not [a related `Origin`](https://www.w3.org/TR/webauthn-3/#sctn-related-origins).\n\nIn the scenario above with _conforming_ client-side checks, this would force the attacker to change the request's RP ID to `hermit-crab.example` (the attacker's `Origin`). This would also change the RP ID hash, [and `webauthn-rs-core` would reject it](https://github.com/kanidm/webauthn-rs/blob/197cddf8487a2dbdd5d374e50d80aa1e4682f3ab/webauthn-rs-core/src/core.rs#L825-L840) (per [WebAuthn §7.2 Step 15](https://www.w3.org/TR/webauthn-3/#rp-op-verifying-assertion-step-rpid-hash)).\n\n### Severity\n\nPer [WebAuthn §13.4.9](https://www.w3.org/TR/webauthn-3/#sctn-validating-origin):\n\n> The [Relying Party](https://www.w3.org/TR/webauthn-3/#relying-party) MUST NOT accept unexpected values of [origin](https://www.w3.org/TR/webauthn-3/#dom-collectedclientdata-origin), as doing so could allow a malicious website to obtain valid [credentials](https://www.w3.org/TR/credential-management-1/#concept-credential). Although the [scope](https://www.w3.org/TR/webauthn-3/#scope) of WebAuthn credentials prevents their use on domains outside the [RP ID](https://www.w3.org/TR/webauthn-3/#rp-id) they were registered for, the [Relying Party](https://www.w3.org/TR/webauthn-3/#relying-party)’s origin validation serves as an additional layer of protection in case a faulty [authenticator](https://www.w3.org/TR/webauthn-3/#authenticator) fails to enforce credential [scope](https://www.w3.org/TR/webauthn-3/#scope).\n\nUnfortunately, [the chain needed to exploit this bug makes it difficult to classify with the CVSS framework](https://www.first.org/cvss/v4.0/user-guide#Vulnerability-Chaining). Kanidm came up with anywhere between \"low\" and \"high\" depending on the approach, and GitHub only provides one CVSS field for everything.\n\nAn attacker could easily bypass a _correctly-implemented_ server-side `Origin` check, if they can convince a target to use their authenticator with [an attacker-controlled client device](https://fidoalliance.org/specs/common-specs/fido-security-ref-v2.1-ps-20220523.html#dfn-t-1.3.2) or [buggy/malicious client application](https://fidoalliance.org/specs/common-specs/fido-security-ref-v2.1-ps-20220523.html#dfn-t-1.3.1). FIDO's Security Reference [assumes that \"the FIDO user device and applications involved in a FIDO operation are trustworthy agents of the user\"](https://fidoalliance.org/specs/common-specs/fido-security-ref-v2.1-ps-20220523.html#dfn-sa-4), and violating that [limits the protections FIDO can provide](https://fidoalliance.org/specs/common-specs/fido-security-ref-v2.1-ps-20220523.html#discussion), so it would be ridiculous to describe those bypasses as a \"high\" severity vulnerability.\n\nHowever, `webauthn-rs-core` should take reasonable steps to prevent these sorts of issues where it can, especially when they're part of the WebAuthn specification.\n\nDue to the complex preconditions and non-default configuration required to execute a successful attack, and that it is *not exploitable* in popular web browsers, Kanidm considers this a **low severity** issue.","state":0,"publishedAt":"2026-05-06T23:31:27+00:00","modifiedAt":"2026-09-10T03:51:04.0390136+00:00","affected":[{"ecosystem":"crates.io","name":"webauthn-rs-core","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.5.5"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"crates.io","name":"webauthn-authenticator-rs","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.6.0-dev"},{"kind":"fixed","version":"0.6.1-dev"}]}],"versions":["0.6.0-dev"],"rawVersionEvidence":null},{"ecosystem":"crates.io","name":"webauthn-rs-core","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.6.0-dev"},{"kind":"fixed","version":"0.6.1-dev"}]}],"versions":["0.6.0-dev"],"rawVersionEvidence":null},{"ecosystem":"crates.io","name":"webauthn-authenticator-rs","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.5.5"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"LOW"}],"references":["https://github.com/kanidm/webauthn-rs/security/advisories/GHSA-22w3-693w-x895","https://github.com/kanidm/webauthn-rs"],"sourceUrl":"https://github.com/advisories/GHSA-22w3-693w-x895","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-22w3-693w-x895","identifiers":["GHSA-22w3-693w-x895"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T11:05:17.2943378+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T11:05:17.2943378+00:00","lastSuccessAt":"2026-11-15T11:05:17.4673918+00:00","error":null,"lastVerifiedAt":"2026-11-15T11:05:17.4673928+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-f90179050d1e68c26defb06294e68ca9aad67fa6285a72a309f2510089445b08","complete":true,"records":425787,"lastAttemptAt":"2026-11-15T11:01:58.8542146+00:00","lastSuccessAt":"2026-11-15T11:01:58.8389797+00:00","error":null,"lastVerifiedAt":"2026-11-15T11:01:58.8542146+00:00","snapshotPublishedAt":"2026-11-15T10:28:09+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-f981543109394c8f9b3df5737aa835e7","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T11:15:00.6236179+00:00","lastSuccessAt":"2026-11-15T11:15:00.619+00:00","error":"257 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T11:15:00.619+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13558,"expectedIdentifiers":13874,"failedIdentifiers":257},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T11:05:17.2943378+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T11:05:17.2943378+00:00","lastSuccessAt":"2026-11-15T11:05:17.4693563+00:00","error":null,"lastVerifiedAt":"2026-11-15T11:05:17.4693566+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-d33b5144615b488f88b7a7390696bc39","complete":true,"records":13833,"lastAttemptAt":"2026-11-15T11:05:18.0594066+00:00","lastSuccessAt":"2026-11-15T10:02:36.038+00:00","error":null,"lastVerifiedAt":"2026-11-15T10:02:36.038+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13874,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T11:05:12.198625+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T11:05:12.198625+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T11:01:59.0034935+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T11:01:59.0034935+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-6086d649bcb454cdf302d7d9275177bda73550e1b6e446b3520e9b6266d3582c","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T11:05:17.2566792+00:00","lastSuccessAt":"2026-11-15T11:05:17.1034234+00:00","error":null,"lastVerifiedAt":"2026-11-15T11:05:17.2566792+00:00","snapshotPublishedAt":"2026-11-15T10:03:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ff18f36f13fcca3a20a3fb9274b59b8872d18869a99071730e1e79b625c8f612","complete":true,"records":232475,"lastAttemptAt":"2026-11-15T11:05:12.0533004+00:00","lastSuccessAt":"2026-11-15T11:05:10.4195883+00:00","error":null,"lastVerifiedAt":"2026-11-15T11:05:12.0533004+00:00","snapshotPublishedAt":"2026-11-15T10:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}