checkFriendlyName concatenates instead of assigning (figure C.3) and produces invalid names on collision with an existing key. For instance, "MyKey" becomes "MyKeyMyKey #2", then "MyKeyMyKey #2MyKey #3", and so on.

private function checkFriendlyName(): void {
	// (...)
	while ( in_array( strtolower( $this->friendlyName ), $friendlyNames ) ) {
		$this->friendlyName .= "$original #$inc";
		$inc++;
	}
}

Figure C.3: Excerpt of WebAuthnKey.php (mediawiki-extensions-OATHAuth/src/Key/WebAuthnKey.php#L252–L271)