Issues

• Add a way for RPs to ensure registration of certain authenticator-supported UV methods

  type:technical
  w3c/webauthn#2482 · Filter by author MasterKale opened on Sep 18, 2026
  11

• Add device binding to cross-device fallback URL extension

  stat:Discusssubtype:FeatureProposal
  w3c/webauthn#2478 · Filter by author iinuwa opened on Sep 8, 2026
  2

• Credential Backup clarification (note about older authenticators)

  type:editorial
  w3c/webauthn#2477 · Filter by author My1 opened on Sep 4, 2026
  4

  

• cmtgKey extension should allow returning more than one key to facilitate rotating keys to a new algorithm

  type:technical
  Bug

  w3c/webauthn#2472 · Filter by author nsatragno opened on Aug 28, 2026
  

• [PQ] SHA-256 usage

  stat:Discusstype:technical
  w3c/webauthn#2471 · Filter by author timcappalli opened on Aug 26, 2026
  7

• Should a CTAP2 virtual authenticator support CTAP1/U2F?

  type:technical
  w3c/webauthn#2468 · Filter by author micolous opened on Aug 18, 2026
  2

  

• Document risks of allowing multiple origins

  subtype:RP-impl-constype:editorial
  w3c/webauthn#2466 · Filter by author emlun opened on Aug 13, 2026
  8

• Hints should not take precendence over transports in an authentication ceremony

  type:technical
  w3c/webauthn#2465 · Filter by author sbweeden opened on Aug 13, 2026
  1

• Virtual authenticator add credential command should handle default parameters better

  type:technical
  w3c/webauthn#2464 · Filter by author nsatragno opened on Aug 7, 2026

• Reference in description of clientDataJSON in AuthenticatorAttestationResponse

  type:editorial
  w3c/webauthn#2461 · Filter by author onavratil-monetplus opened on Aug 4, 2026

• Cross-RP batch enrollment of a backup security key

  stat:Discusssubtype:FeatureProposal
  w3c/webauthn#2460 · Filter by author yubinhu opened on Aug 3, 2026
  1

• Virtual authenticator should clarify what happens when you add a credential with the same { rp id, user id } as an existing credential.

  type:technical
  Bug

  w3c/webauthn#2459 · Filter by author nsatragno opened on Jul 31, 2026
  1

• Hint to deprioritize credential providers that hold a credential in excludeCredentials

  stat:Discusssubtype:FeatureProposal
  w3c/webauthn#2458 · Filter by author kokukuma opened on Jul 30, 2026
  1

• Multiple independent applications on one host

  stat:Discusssubtype:FeatureProposal
  w3c/webauthn#2457 · Filter by author spbooth opened on Jul 29, 2026
  2

• [PQ] Add new batch attestation type for Merkle tree certificates

  type:technical
  w3c/webauthn#2456 · Filter by author ve7jtb opened on Jul 29, 2026
  5

• Virtual authenticator should clarify that ctap2/u2f authenticator cannot have transport=internal (and others).

  type:technical
  Bug

  w3c/webauthn#2453 · Filter by author nsatragno opened on Jul 27, 2026

• Virtual authenticator large blob commands should clarify that the credential must be discoverable

  type:technical
  Bug

  w3c/webauthn#2452 · Filter by author nsatragno opened on Jul 27, 2026
  

• Virtual authenticator set credential properties and remove credential should clarify that credentialId is base64 url encoded

  type:technical
  Bug

  w3c/webauthn#2450 · Filter by author nsatragno opened on Jul 22, 2026

• [PQ] Default Algorithems for Authenticators perhaps need updating.

  type:technical
  w3c/webauthn#2448 · Filter by author ve7jtb opened on Jul 16, 2026
  6

• Virtual Authenticator's get credential should specify how the credential object is serialized

  type:technical
  Bug

  w3c/webauthn#2447 · Filter by author nsatragno opened on Jul 13, 2026
  

• Virtual Authenticator's add credential should probably support more algorithms than ECDSA

  type:technical
  Bug

  w3c/webauthn#2446 · Filter by author nsatragno opened on Jul 13, 2026
  

• "Invoke the authenticatorMakeCredential operation" step is accidentally indented

  type:editorial
  w3c/webauthn#2444 · Filter by author emlun opened on Jul 9, 2026 · L4 (First Published Working Draft)

• Extension input processing directions are inconsistent

  type:technical
  w3c/webauthn#2439 · Filter by author emlun opened on Jul 1, 2026 · L4 (First Published Working Draft)

• Consider portable evidence manifests for attestation auditability

  stat:Discusssubtype:FeatureProposal
  w3c/webauthn#2436 · Filter by author GXP53 opened on Jun 24, 2026
  2

• Discourage bootstrapping new credential provider as part of CREATE call

  type:technical
  w3c/webauthn#2432 · Filter by author rlin1 opened on Jun 2, 2026
  6