### Summary
When `allowed_origins` is configured, `CheckAllowedOrigins` reduces URL-like values to their `host` component and accepts on host match alone. This makes exact origin policies impossible to express: scheme and port differences are silently ignored.

### Details
`CheckAllowedOrigins` stores each configured allowed origin as:

```php
parse_url($allowedOrigin)['host'] ?? $allowedOrigin
```

and later reduces the received `clientDataJSON.origin` the same way:

```php
parse_url($C->origin)['host'] ?? $C->origin
```

If the reduced value matches, the method returns early. As a result, for the normal `allowed_origins` path, the later HTTPS check is not reached.

This differs from [WebAuthn Level 2](https://www.w3.org/TR/webauthn-2/), which requires verifying that `C.origin` matches the RP's origin (scheme + host + port), separately from verifying that `authData.rpIdHash` matches the expected RP ID.

**Affected code:**
- [CheckAllowedOrigins.php](https://github.com/web-auth/webauthn-framework/blob/d58906e/src/webauthn/src/CeremonyStep/CheckAllowedOrigins.php)

**Spec references:**
- [§7.1 Registering a New Credential](https://www.w3.org/TR/webauthn-2/#sctn-registering-a-new-credential)
- [§7.2 Verifying an Authentication Assertion](https://www.w3.org/TR/webauthn-2/#sctn-verifying-assertion)
- [CollectedClientData.origin](https://www.w3.org/TR/webauthn-2/#dom-collectedclientdata-origin)

### PoC
Configuration:

```yaml
webauthn:
allowed_origins:
- https://login.example.com:8443
allow_subdomains: false
```

Send a registration or authentication response whose `clientDataJSON.origin` is:

```text
https://login.example.com:9443
```

**Observed:** the response is accepted, because both values are reduced to `login.example.com`.

**Expected:** the response should be rejected, because `https://login.example.com:8443` and `https://login.example.com:9443` are different origins.

### Impact
This is an origin validation error (CWE-346) affecting deployments that use `allowed_origins`. The most practical browser-facing scenario is same-host / different-port origin confusion. In non-browser or custom clients, scheme confusion may also be relevant.

### Fix
Fixed in version **5.2.4** by rewriting `CheckAllowedOrigins` to perform full origin comparison (scheme + host + port) as required by the WebAuthn spec:

- Origins configured with a scheme (e.g. `https://example.com:8443`) are now stored and compared as full `scheme://host[:port]` values, with default port normalization (443 for HTTPS, 80 for HTTP).
- Origins configured without a scheme are still matched by host only, for backward compatibility.
- Subdomain matching now also verifies scheme and port consistency.

See commit [b4cd9a43](https://github.com/web-auth/webauthn-framework/commit/b4cd9a43).

### Mitigation
Upgrade to `web-auth/webauthn-framework` (or `web-auth/webauthn-lib` / `web-auth/webauthn-symfony-bundle`) **>= 5.2.4**.

CWE-346