Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[5.x]: Passkeys registered with webauthn-lib v4 still fail with an uncaught InvalidUserHandleException (HTTP 500) after the #19530 fix

Aperta
  • Qualcosa non va?
#20,052 1 commento 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@i-just ci sta già lavorando.

Dal 21/10/2026.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
45/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
php
Ambito
authentication, backend

Direzione di ricerca

Start by reading CredentialRepository::findOneByCredentialId(), Auth::verifyPasskey(), and User::authenticateWithPasskey(), then trace the two comparisons in CheckUserHandle::process() from webauthn-lib 5.3.8. Reproduce the v4 record case described in the issue and compare it with the v5 control. Done means v4 passkeys authenticate successfully or fail with a normal authentication response rather than HTTP 500, while v5 passkeys continue to work.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

repo:cms
What happened?

Follow-up to #19530. Craft 5.11.1 replaced the checkOldUserHandle retry with a check in CredentialRepository::findOneByCredentialId(): when the stored userHandle is a raw user UID (a v4-era record), it is base64url-encoded again before validation. That fixes the first comparison in Webauthn\CeremonyStep\CheckUserHandle, but not the second one, so v4-era passkeys still cannot log in.

In CheckUserHandle::process() (webauthn-lib 5.3.8):

  1. Line 39: hash_equals($credentialUserHandle, $userHandle). The stored handle (now base64url(uid)) vs $userEntity->id (base64url(uid)). Passes.
  2. Line 41: hash_equals($credentialUserHandle, $responseUserHandle). The stored handle (base64url(uid)) vs the user handle the authenticator returns. For a passkey registered under v4, the authenticator holds the raw UID as user.id (that is what v4-era Craft sent at registration), so it returns the raw UID. Fails.

Auth::verifyPasskey() rethrows InvalidUserHandleException, and User::authenticateWithPasskey() only catches yii\base\InvalidArgumentException, so the request ends in an HTTP 500 instead of a normal "invalid credentials" response.

The two comparisons need different values for a v4-era record, so no change to the stored data can make both pass. The fix has to be in code.

Steps to reproduce
  1. Create a webauthn row in the v4 format. Its credential JSON has userHandle = base64 of the raw user UID, which is what records written under webauthn-lib v4 look like.
  2. Put the matching credential on an authenticator with user.id = the raw UID. We used a Chrome DevTools Protocol virtual authenticator (WebAuthn.addCredential).
  3. Log in with that passkey (auth/passkey-request-options, then users/login-with-passkey).

Result: HTTP 500, Webauthn\Exception\InvalidUserHandleException: Invalid user handle, thrown at CheckUserHandle.php(41).

Control: the same steps with a v5-format record (stored handle = base64url(uid), and the authenticator user.id = base64url(uid)) return HTTP 200.

Possible fix

For a v4-era record, do not re-encode the stored handle. Instead, pass the raw UID as the expected handle to the validator, so that both comparisons use the raw UID:

  • CredentialRepository::findOneByCredentialId(): keep $credentialRecord->userHandle as the raw UID.
  • Auth::verifyPasskey(): if $credentialRecord->userHandle === $user->uid, pass $user->uid instead of $userEntity->id as the $userHandle argument of check().

Separately, User::authenticateWithPasskey() could treat InvalidUserHandleException as an authentication failure, so that a mismatch produces a normal login error instead of a 500.

Craft CMS version

5.11.1 (production). We also checked that CredentialRepository.php on the 5.x branch is unchanged as of 5.11.5.1.

PHP version

8.4

Operating system and version

Linux

Database type and version

MySQL 8.0

Image driver and version

No response

Installed plugins and versions

Not relevant (core passkey login).

Workaround we used

We deleted the v4-era webauthn rows and asked the affected users to register their passkeys again. After the rows are deleted, an old passkey still on a device gets a normal 400 "authentication failed" response instead of a 500.

Lingua principale
PHP
Stelle
3.6k
Fork
708
Merge medio
10h 57m
PR unite (30g)
275

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di craftcms/cms

Tutte le issue di craftcms/cms

Issue simili

Altre issue su PHP

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.