The Webauthn library's SimpleFakeCredentialGenerator, when instantiated without a secret, produces predictable fake credentials based solely on the username. This predictability allows attackers to distinguish between real and fake usernames, defeating the intended username enumeration protection. The issue affects versions from 4.9.0 up to but not including 5.3.5. The default Symfony bundle configuration is not affected as it injects a non-empty secret. The vulnerability is considered low severity since it only re-enables username enumeration and does not affect the validity of responses.