[Bug]: passkeys not working with packed-attestation

[philfry]

⚠️ This issue respects the following points: ⚠️

• This is not a troubleshooting question, general support matter, or webserver/proxy problem, but likely a bug (if unsure, ask the Community Help Forum).
• This issue is not already reported on Github OR solved at the Community Help Forum (I've searched!).
• I'm using a maintained major version of Nextcloud Server and tested against the latest patch level. (Supported major versions and current patch levels).
• I agree to follow Nextcloud's Code of Conduct.
• I've tried my best to provide clear reproduction steps that someone unfamiliar with this bug could use to reproduce it.

Bug description

I'm using passkeyd to make passkeys work in Linux (w/tpm2.0).
When trying to add a passkey to Nextcloud I get the following error in the logs:

The attestation statement format "packed" is not supported.

passkeyd generates a webauthn attestation object containing fmt = "packed" whereas Nextcloud only supports the none attestation, as seen for example in

server/lib/private/Authentication/WebAuthn/Manager.php

Line 99 in 7826ce0

$attestationStatementSupportManager->add(new NoneAttestationStatementSupport());

Steps to reproduce

1. install passkeyd or any other device that provides packed formatted webauthn objects
2. add passkey to nextcloud
3. watch the logs

Expected behavior

passkey is added to nextcloud

Nextcloud Server version

35

Operating system

RHEL/CentOS

PHP engine version

PHP 8.4

Web server

Nginx

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "nope"
        ],
        "defaultapp": "files",
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "overwrite.cli.url": "http:\/\/localhost",
        "overwritehost": "nope",
        "overwriteprotocol": "https",
        "dbtype": "mysql",
        "version": "35.0.0.10",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "logtimezone": "Europe\/Berlin",
        "installed": true,
        "supportedDatabases": [
            "sqlite",
            "mysql"
        ],
        "knowledgebaseenabled": true,
        "enable_avatars": true,
        "allow_user_to_change_display_name": false,
        "remember_login_cookie_lifetime": 1296000,
        "session_lifetime": 86400,
        "session_keepalive": true,
        "token_auth_enforced": false,
        "auth.bruteforce.protection.enabled": true,
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpdebug": false,
        "mail_smtpmode": "sendmail",
        "htaccess.RewriteBase": "\/",
        "trashbin_retention_obligation": "auto,60",
        "versions_retention_obligation": "auto,60",
        "updatechecker": true,
        "updater.server.url": "***REMOVED SENSITIVE VALUE***",
        "updater.release.channel": "stable",
        "has_internet_connection": true,
        "check_for_working_webdav": true,
        "check_for_working_wellknown_setup": true,
        "check_for_working_htaccess": true,
        "config_is_read_only": false,
        "log_type": "file",
        "logfile": "\/var\/log\/nextcloud\/nextcloud.log",
        "loglevel": 2,
        "log_query": false,
        "cron_log": true,
        "log_rotate_size": false,
        "default_phone_region": "DE",
        "customclient_desktop": "https:\/\/nextcloud.com\/install\/#install-clients",
        "customclient_android": "https:\/\/play.google.com\/store\/apps\/details?id=com.nextcloud.client",
        "customclient_ios": "https:\/\/itunes.apple.com\/us\/app\/nextcloud\/id1125420102?mt=8",
        "appcodechecker": true,
        "appstoreenabled": true,
        "apps_paths": [
            {
                "path": "\/var\/www\/nextcloud\/apps",
                "url": "\/apps",
                "writable": true
            }
        ],
        "enable_previews": true,
        "preview_max_x": 2048,
        "preview_max_y": 2048,
        "preview_max_scale_factor": 10,
        "preview_max_filesize_image": 50,
        "enabledPreviewProviders": [
            "OC\\Preview\\PNG",
            "OC\\Preview\\JPEG",
            "OC\\Preview\\GIF",
            "OC\\Preview\\BMP",
            "OC\\Preview\\XBitmap",
            "OC\\Preview\\MP3",
            "OC\\Preview\\TXT",
            "OC\\Preview\\MarkDown",
            "OC\\Preview\\Image",
            "OC\\Preview\\Illustrator",
            "OC\\Preview\\PDF",
            "OC\\Preview\\Photoshop",
            "OC\\Preview\\Postscript",
            "OC\\Preview\\SVG",
            "OC\\Preview\\TIFF",
            "OC\\Preview\\Font"
        ],
        "ldapUserCleanupInterval": 0,
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 0,
            "timeout": 0,
            "dbindex": 3
        },
        "memcached_servers": [
            [
                "localhost",
                11211
            ]
        ],
        "memcached_options": {
            "14": 50,
            "15": 50,
            "19": 50,
            "20": 50,
            "8": 50,
            "-1001": true,
            "16": true,
            "18": true
        },
        "cipher": "AES-256-CFB",
        "minimum.supported.desktop.version": "2.0.0",
        "filesystem_check_changes": 0,
        "part_file_in_storage": true,
        "mount_file": "\/var\/lib\/nextcloud\/mount.json",
        "filesystem_cache_readonly": false,
        "forwarded_for_headers": [
            "HTTP_X_FORWARDED",
            "HTTP_FORWARDED_FOR",
            "HTTP_X_FORWARDED_FOR"
        ],
        "max_filesize_animated_gifs_public_sharing": 10,
        "filelocking.enabled": true,
        "filelocking.ttl": 3600,
        "upgrade.disable-web": true,
        "data-fingerprint": "",
        "maintenance": false,
        "singleuser": false,
        "debug": false,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "ldapProviderFactory": "\\OCA\\User_LDAP\\LDAPProviderFactory",
        "mail_smtpauthtype": "LOGIN",
        "mail_smtpsecure": "tls",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "simpleSignUpLink.shown": false,
        "mysql.utf8mb4": true,
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "maintenance_window_start": 2
    }
}

List of activated Apps

Enabled:
  - app_api: 35.0.0
  - appstore: 2.0.0-dev.0
  - bruteforcesettings: 8.0.0
  - calendar: 6.6.1
  - circles: 35.0.0
  - cloud_federation_api: 2.0.0-dev.0
  - comments: 2.0.0-dev.0
  - contacts: 8.9.0
  - contactsinteraction: 2.0.0-dev.0
  - dashboard: 8.0.0-dev.0
  - dav: 2.0.0-dev.1
  - end_to_end_encryption: 2.2.4
  - federatedfilesharing: 2.0.0-dev.1
  - files: 3.0.0-dev.0
  - files_downloadlimit: 5.3.0
  - files_external: 2.0.0-dev.0
  - files_lock: 35.0.0
  - files_pdfviewer: 8.0.0
  - files_reminders: 2.0.0-dev.0
  - files_sharing: 2.0.0-dev.1
  - files_trashbin: 2.0.0-dev.0
  - files_versions: 2.0.0-dev.0
  - logreader: 8.0.0
  - lookup_server_connector: 2.0.0-dev.0
  - music: 3.2.1
  - notes: 6.1.0
  - notifications: 8.0.0
  - oauth2: 2.0.0-dev.0
  - office: 1.1.0
  - photos: 8.0.0
  - privacy: 7.0.0
  - profile: 2.0.0-dev.0
  - provisioning_api: 2.0.0-dev.0
  - qownnotesapi: 26.8.0
  - recommendations: 8.0.0
  - related_resources: 6.0.0
  - serverinfo: 7.0.0
  - settings: 2.0.0-dev.0
  - sharebymail: 2.0.0-dev.0
  - sharing: 1.0.4
  - support: 7.0.0
  - survey_client: 7.0.0
  - suspicious_login: 13.0.0
  - systemtags: 2.0.0-dev.0
  - text: 9.0.0
  - theming: 3.0.0-dev.0
  - twofactor_backupcodes: 2.0.0-dev.0
  - twofactor_totp: 17.1.0
  - updatenotification: 2.0.0-dev.0
  - user_ldap: 2.0.0-dev.0
  - user_status: 2.0.0-dev.0
  - viewer: 8.0.0
  - webhook_listeners: 2.0.0-dev.0
  - workflowengine: 3.0.0-dev.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

{
  "reqId": "gRwgeTtdlf42DDk8MzvH",
  "level": 3,
  "time": "2026-09-23T12:10:07+02:00",
  "user": "phil",
  "app": "index",
  "method": "POST",
  "url": "/settings/api/personal/webauthn/registration",
  "scriptName": "/index.php",
  "message": "Unable to load the data",
  "userAgent": "Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0",
  "version": "35.0.0.10",
  "exception": {
    "Exception": "Webauthn\\Exception\\InvalidDataException",
    "Message": "Unable to load the data",
    "Code": 0,
    "Trace": [
      {
        "file": "/var/www/nextcloud/3rdparty/web-auth/webauthn-lib/src/PublicKeyCredentialLoader.php",
        "line": 125,
        "function": "create",
        "class": "Webauthn\\Exception\\InvalidDataException",
        "type": "::",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/var/www/nextcloud/lib/private/Authentication/WebAuthn/Manager.php",
        "line": 118,
        "function": "load",
        "class": "Webauthn\\PublicKeyCredentialLoader",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/apps/settings/lib/Controller/WebAuthnController.php",
        "line": 76,
        "function": "finishRegister",
        "class": "OC\\Authentication\\WebAuthn\\Manager",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php",
        "line": 198,
        "function": "finishRegistration",
        "class": "OCA\\Settings\\Controller\\WebAuthnController",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php",
        "line": 86,
        "function": "executeController",
        "class": "OC\\AppFramework\\Http\\Dispatcher",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/lib/private/AppFramework/App.php",
        "line": 138,
        "function": "dispatch",
        "class": "OC\\AppFramework\\Http\\Dispatcher",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/lib/private/Route/Router.php",
        "line": 324,
        "function": "main",
        "class": "OC\\AppFramework\\App",
        "type": "::"
      },
      {
        "file": "/var/www/nextcloud/lib/OC.php",
        "line": 1232,
        "function": "match",
        "class": "OC\\Route\\Router",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/index.php",
        "line": 28,
        "function": "handleRequest",
        "class": "OC",
        "type": "::"
      },
      {
        "file": "/var/www/nextcloud/lib/OC.php",
        "line": 1397,
        "function": "{closure:/var/www/nextcloud/index.php:25}",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/var/www/nextcloud/index.php",
        "line": 25,
        "function": "handleRequests",
        "class": "OC",
        "type": "::"
      }
    ],
    "File": "/var/www/nextcloud/3rdparty/web-auth/webauthn-lib/src/Exception/InvalidDataException.php",
    "Line": 21,
    "Previous": {
      "Exception": "Webauthn\\Exception\\InvalidDataException",
      "Message": "The attestation statement format \"packed\" is not supported.",
      "Code": 0,
      "Trace": [
        {
          "file": "/var/www/nextcloud/3rdparty/web-auth/webauthn-lib/src/AttestationStatement/AttestationStatementSupportManager.php",
          "line": 45,
          "function": "create",
          "class": "Webauthn\\Exception\\InvalidDataException",
          "type": "::",
          "args": [
            "*** sensitive parameters replaced ***"
          ]
        },
        {
          "file": "/var/www/nextcloud/3rdparty/web-auth/webauthn-lib/src/AttestationStatement/AttestationObjectLoader.php",
          "line": 85,
          "function": "get",
          "class": "Webauthn\\AttestationStatement\\AttestationStatementSupportManager",
          "type": "->"
        },
        {
          "file": "/var/www/nextcloud/3rdparty/web-auth/webauthn-lib/src/PublicKeyCredentialLoader.php",
          "line": 158,
          "function": "load",
          "class": "Webauthn\\AttestationStatement\\AttestationObjectLoader",
          "type": "->"
        },
        {
          "file": "/var/www/nextcloud/3rdparty/web-auth/webauthn-lib/src/PublicKeyCredentialLoader.php",
          "line": 93,
          "function": "createResponse",
          "class": "Webauthn\\PublicKeyCredentialLoader",
          "type": "->",
          "args": [
            "*** sensitive parameters replaced ***"
          ]
        },
        {
          "file": "/var/www/nextcloud/3rdparty/web-auth/webauthn-lib/src/PublicKeyCredentialLoader.php",
          "line": 120,
          "function": "loadArray",
          "class": "Webauthn\\PublicKeyCredentialLoader",
          "type": "->"
        },
        {
          "file": "/var/www/nextcloud/lib/private/Authentication/WebAuthn/Manager.php",
          "line": 118,
          "function": "load",
          "class": "Webauthn\\PublicKeyCredentialLoader",
          "type": "->"
        },
        {
          "file": "/var/www/nextcloud/apps/settings/lib/Controller/WebAuthnController.php",
          "line": 76,
          "function": "finishRegister",
          "class": "OC\\Authentication\\WebAuthn\\Manager",
          "type": "->"
        },
        {
          "file": "/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php",
          "line": 198,
          "function": "finishRegistration",
          "class": "OCA\\Settings\\Controller\\WebAuthnController",
          "type": "->"
        },
        {
          "file": "/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php",
          "line": 86,
          "function": "executeController",
          "class": "OC\\AppFramework\\Http\\Dispatcher",
          "type": "->"
        },
        {
          "file": "/var/www/nextcloud/lib/private/AppFramework/App.php",
          "line": 138,
          "function": "dispatch",
          "class": "OC\\AppFramework\\Http\\Dispatcher",
          "type": "->"
        },
        {
          "file": "/var/www/nextcloud/lib/private/Route/Router.php",
          "line": 324,
          "function": "main",
          "class": "OC\\AppFramework\\App",
          "type": "::"
        },
        {
          "file": "/var/www/nextcloud/lib/OC.php",
          "line": 1232,
          "function": "match",
          "class": "OC\\Route\\Router",
          "type": "->"
        },
        {
          "file": "/var/www/nextcloud/index.php",
          "line": 28,
          "function": "handleRequest",
          "class": "OC",
          "type": "::"
        },
        {
          "file": "/var/www/nextcloud/lib/OC.php",
          "line": 1397,
          "function": "{closure:/var/www/nextcloud/index.php:25}",
          "args": [
            "*** sensitive parameters replaced ***"
          ]
        },
        {
          "file": "/var/www/nextcloud/index.php",
          "line": 25,
          "function": "handleRequests",
          "class": "OC",
          "type": "::"
        }
      ],
      "File": "/var/www/nextcloud/3rdparty/web-auth/webauthn-lib/src/Exception/InvalidDataException.php",
      "Line": 21
    },
    "message": "Unable to load the data",
    "exception": "{\"class\":\"Webauthn\\Exception\\InvalidDataException\",\"message\":\"Unable to load the data\",\"code\":0,\"file\":\"/var/www/nextcloud/3rdparty/web-auth/webauthn-lib/src/Exception/InvalidDataException.php:21\",\"trace\":\"#0 /var/www/nextcloud/3rdparty/web-auth/webauthn-lib/src/PublicKeyCredentialLoader.php(125): Webauthn\\Exception\\InvalidDataException::create()\\n#1 /var/www/nextcloud/lib/private/Authentication/WebAuthn/Manager.php(118): Webauthn\\PublicKeyCredentialLoader->load()\\n#2 /var/www/nextcloud/apps/settings/lib/Controller/WebAuthnController.php(76): OC\\Authentication\\WebAuthn\\Manager->finishRegister()\\n#3 /var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php(198): OCA\\Settings\\Controller\\WebAuthnController->finishRegistration()\\n#4 /var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php(86): OC\\AppFramework\\Http\\Dispatcher->executeController()\\n#5 /var/www/nextcloud/lib/private/AppFramework/App.php(138): OC\\AppFramework\\Http\\Dispatcher->dispatch()\\n#6 /var/www/nextcloud/lib/private/Route/Router.php(324): OC\\AppFramework\\App::main()\\n#7 /var/www/nextcloud/lib/OC.php(1232): OC\\Route\\Router->match()\\n#8 /var/www/nextcloud/index.php(28): OC::handleRequest()\\n#9 /var/www/nextcloud/lib/OC.php(1397): {closure:/var/www/nextcloud/index.php:25}()\\n#10 /var/www/nextcloud/index.php(25): OC::handleRequests()\\n#11 {main}\",\"previous\":{\"class\":\"Webauthn\\Exception\\InvalidDataException\",\"message\":\"The attestation statement format \\\"packed\\\" is not supported.\",\"code\":0,\"file\":\"/var/www/nextcloud/3rdparty/web-auth/webauthn-lib/src/Exception/InvalidDataException.php:21\",\"trace\":\"#0 /var/www/nextcloud/3rdparty/web-auth/webauthn-lib/src/AttestationStatement/AttestationStatementSupportManager.php(45): Webauthn\\Exception\\InvalidDataException::create()\\n#1 /var/www/nextcloud/3rdparty/web-auth/webauthn-lib/src/AttestationStatement/AttestationObjectLoader.php(85): Webauthn\\AttestationStatement\\AttestationStatementSupportManager->get()\\n#2 /var/www/nextcloud/3rdparty/web-auth/webauthn-lib/src/PublicKeyCredentialLoader.php(158): Webauthn\\AttestationStatement\\AttestationObjectLoader->load()\\n#3 /var/www/nextcloud/3rdparty/web-auth/webauthn-lib/src/PublicKeyCredentialLoader.php(93): Webauthn\\PublicKeyCredentialLoader->createResponse()\\n#4 /var/www/nextcloud/3rdparty/web-auth/webauthn-lib/src/PublicKeyCredentialLoader.php(120): Webauthn\\PublicKeyCredentialLoader->loadArray()\\n#5 /var/www/nextcloud/lib/private/Authentication/WebAuthn/Manager.php(118): Webauthn\\PublicKeyCredentialLoader->load()\\n#6 /var/www/nextcloud/apps/settings/lib/Controller/WebAuthnController.php(76): OC\\Authentication\\WebAuthn\\Manager->finishRegister()\\n#7 /var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php(198): OCA\\Settings\\Controller\\WebAuthnController->finishRegistration()\\n#8 /var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php(86): OC\\AppFramework\\Http\\Dispatcher->executeController()\\n#9 /var/www/nextcloud/lib/private/AppFramework/App.php(138): OC\\AppFramework\\Http\\Dispatcher->dispatch()\\n#10 /var/www/nextcloud/lib/private/Route/Router.php(324): OC\\AppFramework\\App::main()\\n#11 /var/www/nextcloud/lib/OC.php(1232): OC\\Route\\Router->match()\\n#12 /var/www/nextcloud/index.php(28): OC::handleRequest()\\n#13 /var/www/nextcloud/lib/OC.php(1397): {closure:/var/www/nextcloud/index.php:25}()\\n#14 /var/www/nextcloud/index.php(25): OC::handleRequests()\\n#15 {main}\"}}",
    "CustomMessage": "Unable to load the data"
  }
}

Additional info

No response