Executive brief
Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection
Affected products
- Packagist web-auth/webauthn-lib
Junglewise Threat Intelligence
Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protectio
Severity: medium · CVSS 4 · Published 2026-07-07
Technologies: web-auth/webauthn-lib (Packagist). Vendors: Packagist.