GHSA-gq4g-fpc9-vjfq: Username Enumeration via Predictable Decoy Credentials in web-auth/webauthn-lib

The web-auth/webauthn-lib library implements WebAuthn (FIDO2) authentication for PHP applications. A critical defense mechanism in multi-user authentication interfaces is the mitigation of username enumeration. When an unauthenticated request is received, the server must behave consistently whether the user exists or not.

To accomplish this, secure WebAuthn implementations return fake credential descriptors when a user is not found. The SimpleFakeCredentialGenerator class serves as the default library-provided mechanism to generate these decoy descriptors. This ensures the client receives a populated list of allowed credentials in both scenarios.

However, the default implementation generates predictable responses if it is not configured with a secure cryptographic key. An attacker can analyze the returned credentials to determine account existence on the target system. This leads to information disclosure through discrepancies in response values.

The root cause of the vulnerability lies in the implementation of the seed generation algorithm inside Webauthn\SimpleFakeCredentialGenerator. The generator creates a deterministic seed by hashing the username combined with a configured secret key.

When the generator is instantiated, the $secret constructor argument defaults to an empty string. If the application developer does not explicitly provide a high-entropy secret, the seed calculation simplifies to hashing only the attacker-controlled username.

Because the hashing process is entirely deterministic and uses public parameters, an attacker can reproduce the entire generation process locally. By feeding arbitrary usernames into a local simulation of the algorithm, the attacker can precompute the exact fake credential IDs and transport options that the server would return for any non-existent user.

Let us examine the vulnerable constructor signature in the SimpleFakeCredentialGenerator class. The parameter $secret is defined as an optional string parameter with an empty default value.

// Vulnerable implementation in web-auth/webauthn-lib
public function __construct(
    private string $secret = '', // Insecure default value
    // ... other parameters
) {
}

The generation of the decoy descriptors relies on the $secret property. The library uses the hash function with the SHA-256 algorithm to derive the cryptographic seed for the credentials.

// Seed derivation logic
$seed = hash('sha256', $username . $this->secret, true);

In version 5.3.5, the vendor mitigated the issue by adding validation and triggering deprecation warnings when an empty secret is detected. Future major versions will enforce a non-empty string requirement.

// Mitigation introduced in version 5.3.5
if ($this->secret === '') {
    trigger_deprecation(
        'web-auth/webauthn-lib',
        '5.3.5',
        'Using an empty secret in SimpleFakeCredentialGenerator is deprecated and will be removed in 6.0.0.'
    );
}

To exploit the vulnerability, an attacker first selects a target email address or username. Using a local copy of the PHP derivation algorithm, the attacker generates the expected decoy credentials for that identity using an empty secret.

The attacker then initiates an authentication session on the target server using the target username. The server processes the request and returns a list of allowed credential descriptors to the client.

The attacker compares the returned list against the precomputed local decoys. If the lists match exactly, the username does not exist on the server. If they differ, the server has returned the real public key credential descriptors belonging to an active account.

Here is a visual overview of this validation discrepancy:

The security impact of this vulnerability is classified as Low with a CVSS score of 2.3. The vulnerability does not allow remote code execution, privilege escalation, or unauthorized access to user accounts.

The primary impact is the complete bypass of the username enumeration defenses implemented by the WebAuthn library. Attackers can reliably build lists of registered users on the target platform by automating queries against the endpoint.

This structured exposure of user presence supports subsequent target reconnaissance campaigns. Attackers can leverage the collected active usernames for highly targeted spear-phishing, credential stuffing, or social engineering attacks.

Organizations using web-auth/webauthn-lib must upgrade to version 5.3.5 or later. This ensures that the application receives proper runtime warnings and prepares the codebase for strict validation in major version 6.0.0.

When utilizing the library programmatically, developers must explicitly pass a cryptographically secure, high-entropy string as the secret parameter. Do not rely on default parameters during instantiation.

If using the Symfony integration, the bundle handles configuration automatically by injecting the application's global secret. Ensure the kernel.secret parameter in your Symfony framework configuration is set to a secure, non-default value.