Executive brief
A security feature in the Webauthn library, designed to prevent attackers from guessing valid usernames, is ineffective when used with default settings. This component normally generates fake login data for non-existent users so that an attacker cannot tell the difference between a real account and a fake one. Because the default configuration uses an empty secret key, an attacker can predict exactly what the fake data will look like, allowing them to identify which usernames actually exist on the system.
Technical details
The `SimpleFakeCredentialGenerator` in `web-auth/webauthn-lib` is designed to mitigate username enumeration by returning stable decoy `PublicKeyCredentialDescriptor` objects for unknown users. However, the generator's constructor defaults to an empty string for its secret. Because the seed for generating these decoys is derived using a public algorithm (`hash('sha256', $username . $this->secret)`) and the secret is empty by default, an unauthenticated remote attacker can locally pre-compute the expected decoy list for any username. By comparing the server's response to their calculated decoys, the attacker can determine if a username is valid or not. This has been patched in version 5.3.5 by adding deprecation warnings for empty secrets, with a non-empty secret becoming mandatory in version 6.0.0.
Affected products
- web-auth webauthn-lib >= 4.9.0, < 5.3.5
Timeline
- 2026-05-31: disclosed
- 2026-07-07: advisory: GitHub Advisory published
- 2026-07-07: patched: Fixed in version 5.3.5