web-auth webauthn-framework

• CVE-2026-30964 Medium 5.4 Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation 0.2%
• CVE-2024-39912 Medium 5.3 Enumeration of valid usernames in web-auth/webauthn-lib 0.4%