Maniphest T427227

Webauthn authentication fails when using webauthn-lib >=5.3.0
Closed, ResolvedPublicBUG REPORT
Actions

Assigned To

Authored By

	Pskyechology
	May 25 2026, 7:57 PM

Project Tags

Referenced Files

None

Subscribers

SomeRandomDeveloper

Description

Steps to replicate the issue (include links if applicable):

Use Webauthn as 2FA
Attempt login

What happens?:
WebAuthn authentication failed due to: MediaWiki\\Extension\\OATHAuth\\Key\\WebAuthnKey::findOneByCredentialId(): Return value must be of type ?Webauthn\\PublicKeyCredentialSource, Webauthn\\CredentialRecord returned

What should have happened instead?:
Login is successful.

Software version (on Special:Version page; skip for WMF-hosted wikis like Wikipedia):
MediaWiki 1.46.0-beta (9be2edf)
OATHAuth (REL1_46, 163737a)
web-auth/webauthn-lib 5.3.2

Other information (browser name/version, screenshots, etc.):
This is caused by a change in upstream >=5.3.0 and can be fixed by backporting the change https://gerrit.wikimedia.org/r/1282425, or limiting the lib's version to <5.3.0 where not possible.

Details

Related Changes in Gerrit:

	Subject	Author	Repo	Branch	Lines +/-
	Upgrading web-auth/webauthn-lib (5.2.6 => 5.3.2)	Reedy	mediawiki/extensions/OATHAuth	REL1_46	+4 -4
	Upgrading web-auth/webauthn-lib (5.2.6 => 5.3.2)	Reedy	mediawiki/vendor	REL1_46	+2 K -619
	Upgrading web-auth/webauthn-lib (5.2.4 => 5.2.6)	Reedy	mediawiki/extensions/OATHAuth	REL1_46	+1 -1
	Upgrading web-auth/webauthn-lib (5.2.4 => 5.2.6)	Reedy	mediawiki/vendor	REL1_46	+53 -68

Customize query in gerrit

Related Objects

Mentioned Here: rEOAT163737a74bbd: Localisation updates from https://translatewiki.net.
rMW9be2edf271cf: ApiQueryInfo: Pass an empty string instead of null to EditFormPreloadText hook

Event Timeline

Pskyechology created this task.May 25 2026, 7:57 PM

Restricted Application added a project: Product Safety and Integrity. · View Herald TranscriptMay 25 2026, 7:57 PM

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

SomeRandomDeveloper subscribed.May 25 2026, 8:09 PM

MacFan4000 subscribed.May 25 2026, 8:16 PM

Reedy added a project: MW-1.46-release.May 25 2026, 8:26 PM

Something something semver something something...

Change #1293163 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/vendor@REL1_46] Upgrading web-auth/webauthn-lib (5.2.4 => 5.2.6)

https://gerrit.wikimedia.org/r/1293163

Change #1293164 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/vendor@REL1_46] Upgrading web-auth/webauthn-lib (5.2.6 => 5.3.2)

https://gerrit.wikimedia.org/r/1293164

Change #1293165 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OATHAuth@REL1_46] Upgrading web-auth/webauthn-lib (5.2.4 => 5.2.6)

https://gerrit.wikimedia.org/r/1293165

Change #1293166 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OATHAuth@REL1_46] Upgrading web-auth/webauthn-lib (5.2.6 => 5.3.2)

https://gerrit.wikimedia.org/r/1293166

Change #1293163 merged by Reedy:

[mediawiki/vendor@REL1_46] Upgrading web-auth/webauthn-lib (5.2.4 => 5.2.6)

https://gerrit.wikimedia.org/r/1293163

Change #1293165 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@REL1_46] Upgrading web-auth/webauthn-lib (5.2.4 => 5.2.6)

https://gerrit.wikimedia.org/r/1293165

Change #1293164 merged by Reedy:

[mediawiki/vendor@REL1_46] Upgrading web-auth/webauthn-lib (5.2.6 => 5.3.2)

https://gerrit.wikimedia.org/r/1293164

Change #1293166 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@REL1_46] Upgrading web-auth/webauthn-lib (5.2.6 => 5.3.2)

https://gerrit.wikimedia.org/r/1293166

Thanks!

Maintenance_bot removed a project: Patch-For-Review.May 25 2026, 9:30 PM