{"id":"GHSA-q683-8468-r6h6","title":"WebauthnAuthenticator leaks sensitive HTTP headers through INFO-level logs","summary":"WebauthnAuthenticator leaks sensitive HTTP headers through INFO-level logs","severity":"medium","cwe":["CWE-200","CWE-532"],"vendor":"web-auth","product":"web-auth/webauthn-symfony-bundle","ecosystem":"composer","affected":["web-auth/webauthn-symfony-bundle < 5.3.4"],"patched":["web-auth/webauthn-symfony-bundle 5.3.4"],"published":"2026-06-26","updated":"2026-06-26","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-q683-8468-r6h6","references":[{"url":"https://github.com/web-auth/webauthn-framework/security/advisories/GHSA-q683-8468-r6h6"},{"url":"https://github.com/advisories/GHSA-q683-8468-r6h6"}],"tags":["ghsa","composer"],"ingestedAt":"2026-06-29T13:24:35.250Z","slug":"GHSA-q683-8468-r6h6","body":"## Overview\n\n## Impact\n\n`Webauthn\\Bundle\\Security\\Http\\Authenticator\\WebauthnAuthenticator` logs the full `Symfony\\Component\\HttpFoundation\\Request` object inside the log context of both `onAuthenticationSuccess()` and `onAuthenticationFailure()` at INFO level:\n\n```php\n$this->logger->info('User has been authenticated successfully with Webauthn.', [\n    'request' => $request,\n    'firewallName' => $firewallName,\n    'identifier' => $token->getUserIdentifier(),\n]);\n\n$this->logger->info('Webauthn authentication request failed.', [\n    'request' => $request,\n    'exception' => $exception,\n]);\n```\n\n`Request::__toString()` returns the raw HTTP message, including every request header. As soon as the configured logger normalises or stringifies the context (default behaviour for `LineFormatter`, `JsonFormatter` via `NormalizerFormatter`, etc.), sensitive headers such as `Cookie` (session identifier), `Authorization` and any custom auth header are written to the log stream in clear text.\n\nApplications that forward logs to centralised platforms (ELK, Splunk, Datadog and similar) are particularly exposed: log access is typically broader than application access, which can allow log readers to hijack authenticated sessions.\n\n## Affected versions\n\nEvery release prior to 5.3.4 is affected.\n\n## Patches\n\nThe fix removes the full `Request` object from the log context and keeps only non-sensitive fields (request path, method, firewall name, user identifier). It is shipped in 5.3.4. Older branches will not receive a backport; users on those branches should upgrade to 5.3.4+ or apply one of the workarounds below.\n\n## Workarounds\n\nUntil the upgrade is applied, projects can:\n\n1. Raise the minimum log level for the WebAuthn authenticator above INFO so these two log records are not emitted in production.\n2. Configure their Monolog processor/formatter to strip the `request` key from the context of these records before they are written.\n\n## Credit\n\nReported by Kay Joosten (Dawn Technology), maintainer of [Stepup-Webauthn](https://github.com/OpenConext/Stepup-Webauthn).\n\n## Affected packages\n\n- `web-auth/webauthn-symfony-bundle < 5.3.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `web-auth/webauthn-symfony-bundle 5.3.4`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}