Passkeys Supplied Without User Verification Should Not Satisfy MFA #361

New issue

Closed

opened 2026-04-08 17:40:23 -05:00 by notquitenothing · 1 comment

notquitenothing commented

2026-04-08 17:40:23 -05:00

(Migrated from github.com)

Describe the bug:

If a user signs in with a passkey but does not supply user verification, an important step of MFA has been missed. MFA enabled accounts (or when MFA is needed due to some other requirement) should not be able to sign in a hardware token alone. A PIN or biometric or password should always also be required.

To Reproduce:

Using a Yubikey without PIN, I am able to sign-in to an MFA enabled account

Expected behavior:

I should be redirected to the MFA page to continue sign-in. Passkeys should serve as either a first-factor or second-factor (due to credential storing) but not both without user verification.

Database Driver:

N/A

This has been somewhat discussed in #311 and #106

### Describe the bug: If a user signs in with a passkey but does not supply user verification, an important step of MFA has been missed. MFA enabled accounts (or when MFA is needed due to some other requirement) should not be able to sign in a hardware token alone. A PIN or biometric or password should always also be required. ### To Reproduce: Using a Yubikey without PIN, I am able to sign-in to an MFA enabled account ### Expected behavior: I should be redirected to the MFA page to continue sign-in. Passkeys should serve as either a first-factor or second-factor (due to credential storing) but not both without user verification. ### Database Driver: N/A This has been somewhat discussed in #311 and #106

notquitenothing commented

2026-04-26 09:35:53 -05:00

(Migrated from github.com)

Now fixed in release v1.12.0

Now fixed in release [v1.12.0](https://github.com/voidauth/voidauth/releases/tag/v1.12.0)