microg / microg/GmsCore

FIDO/CTAP: Account chooser not shown during username-less login with multiple accounts

Open
#3,565 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Java
Stars
14.6k
Forks
3.2k
Avg merge
12d 11h
Merged PRs (30d)
4

Description

Describe the bug
When attempting a username-less login using a FIDO2.1 security key that contains multiple discoverable credentials, the system automatically defaults to logging into one of the accounts without displaying an account chooser.

To Reproduce
Steps to reproduce the behavior:

Go to 'https://webauthn.io/'

Enable the "Discoverable Credential" option and register account A.

Repeat the steps to register account B and account C under the same settings.

Clear the username field on the login page and click "Log In".

Complete the authentication, and observe that the system automatically logs into one of the accounts by default without presenting any choices.

Expected behavior
When the username field is left blank, an account chooser (credential selector) should be triggered, allowing the user to manually select which account (A, B, or C) to log into.

Screenshots
(Add screenshots here if needed)

System
Android Version: 15
Custom ROM: None

Additional context
Authenticator Device: FIDO2.1 Security Key (NFC/USB)

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the username-less login on https://webauthn.io/ with multiple discoverable credentials using an Android 15 device and a FIDO2.1 security key. Start by tracing the Android FIDO/CTAP authentication flow and credential-selection handling. Done means blank-username authentication presents a chooser for accounts A, B, and C instead of selecting one automatically.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, java
Domain
authentication, mobile
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.