Enrolled 2 yubikeys, and then tried to remove them. I had to have the same key plugged in to be able to remove it
This causes problems if you've lost a key, and want to remove it because you no longer trust it
Description
Description
Event Timeline
Comment Actions
I didn't test this but looked through the code (while looking at {T268384}), and I don't think this is the case - the disable form eventually calls WebAuthn::verify() which doesn't privilege any key.
You need to use the same module to remove a key (e.g. you can't use TOTP to remove a WebAuthn key), which is not ideal, but not that big a deal.
Comment Actions
Boldly closing this as invalid since I also could not reproduce. I added a Yubikey and a passkey, and I could use either to remove either.