microg / microg/GmsCore

FIDO/CTAP : Duplicate PIN verification issue with Yubikey 5c NFC on Android 15

Open
#3,564 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Java
Stars
14.6k
Forks
3.2k
Avg merge
12d 11h
Merged PRs (30d)
4

Description

Describe the bug
When registering on webauthn.io with the configuration shown in the screenshot, the system prompts for the PIN a second time after the initial PIN verification and tapping the Yubikey.

To Reproduce
Steps to reproduce the behavior:

Configure the options on webauthn.io as shown in the screenshot.

Click on the registration button.

Verify the PIN when prompted, then tap the Yubikey 5c NFC.

Notice that the system incorrectly requests the PIN verification again.

Expected behavior
Registration should succeed immediately after the initial key tap, rather than prompting for the PIN a second time.

Screenshots

Image

System
Android Version: 15
Custom ROM: Android
Hardware: Yubikey 5c NFC

Additional context
Found this issue during testing with s1m/hw-fido2-provider. Notably, other custom security keys work perfectly fine.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the registration flow on Android 15 with a Yubikey 5c NFC using the webauthn.io configuration described in the issue, and compare it with another custom security key. Trace the FIDO/CTAP interaction and the s1m/hw-fido2-provider path; done means the initial PIN verification and key tap complete registration without a second PIN prompt.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, java
Domain
authentication, mobile-dev
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.