The SimpleFakeCredentialGenerator in the web-auth/webauthn-lib library generates decoy PublicKeyCredentialDescriptor objects to mitigate username enumeration by making assertion requests for unknown users indistinguishable from real ones. However, when constructed without a secret (default is an empty string), the seed for generating decoys depends solely on the attacker-controlled username. This allows an unauthenticated attacker to reproduce the exact decoy list and determine if a username exists. The defect lies in the empty default secret, not the algorithm itself. The issue affects versions >=4.9.0 and <5.3.5. The vulnerability was fixed in version 5.3.5 by requiring a non-empty secret and emitting deprecation warnings for empty secrets. The Symfony bundle is unaffected by default as it uses a non-empty application secret.

The vulnerability allows attackers to perform username enumeration by comparing the predictable fake credential responses generated without a secret. This undermines the username enumeration protection mechanism but does not affect the validity or security of actual credentials or authentication. The impact is limited to information disclosure about the existence of usernames.

A fix is available in version 5.3.5 of web-auth/webauthn-lib. Users should upgrade to 5.3.5 or later. Until then, ensure that SimpleFakeCredentialGenerator is constructed with a non-empty, deployment-specific secret (e.g., the application secret). The Symfony bundle is not affected by default as it injects a non-empty secret. The library emits deprecation warnings when constructed without a secret to help detect misconfigurations. Providing a custom FakeCredentialGenerator implementation seeded with a secret is also a valid workaround.