2FA bypass of Webauthn-only accounts

Getting advice
8

Hello, I am working in the same team as dickon, on the same issue. I work on the Master realm.

  1. When I set the authentication flow as in the image above and then I sign out, try to sign in afterwards, I get an invalid credentials error without even being required to fill in the username and password and the only thing that I could do is setting up a new Docker image again.Why am I dealing with this error?

  2. When I set the “browser with otp webauthn Browser- OTP or WebAuthnN” sub-flow as Alternative, by having only the Webauthn method configured, a Yubikey, after I login for the first time with it, the next times it won’t require me a second authentication factor. The same happens when I login on another realm than admin.