{"record":{"id":"103ef47325c499d3","repo":"apereo/cas","slug":"assertion-failed","errorCode":null,"errorMessage":"Assertion failed","messagePattern":"Assertion failed","errorType":"exception","errorClass":"AssertionFailedException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-webauthn-core/src/main/java/com/yubico/core/WebAuthnServer.java","lineNumber":253,"sourceCode":"                            e\n                        );\n                    }\n\n                    val session = sessionManager.createSession(request, assertionResult.getCredential().getUserHandle());\n                    return Either.right(\n                        new SuccessfulAuthenticationResult(\n                            assertionRequestWrapper,\n                            assertionResponse,\n                            userStorage.getRegistrationsByUsername(assertionResult.getUsername()),\n                            assertionResult.getUsername(),\n                            session\n                        )\n                    );\n                } else {\n                    return Either.left(List.of(\"Assertion failed: Invalid assertion.\"));\n                }\n            } catch (final AssertionFailedException e) {\n                LOGGER.warn(\"Assertion failed\", e);\n                return Either.left(List.of(\"Assertion failed\", e.getMessage()));\n            } catch (final Exception e) {\n                LOGGER.error(\"Assertion failed\", e);\n                return Either.left(List.of(\"Assertion failed unexpectedly; this is likely a bug.\", e.getMessage()));\n            }\n        }\n    }\n\n    @Value\n    public static class SuccessfulRegistrationResult {\n        boolean success;\n\n        RegistrationRequest request;\n\n        RegistrationResponse response;\n\n        CredentialRegistration registration;\n","sourceCodeStart":235,"sourceCodeEnd":271,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-webauthn-core/src/main/java/com/yubico/core/WebAuthnServer.java#L235-L271","documentation":"WebAuthn authentication finished but the assertion could not be verified by the Yubico WebAuthn server. The server returns the failure as a list of error messages rather than throwing; 'Assertion failed: Invalid assertion.' is the generic mismatch path, AssertionFailedException is the library-detected path, and unexpected exceptions are reported as a likely bug.","triggerScenarios":"finishAuthentication() is called with a request whose signature, challenge, origin, RP ID, user handle, or credential counter does not match the stored credential (AssertionFailedException), or whose assertion is structurally invalid (generic 'Invalid assertion' branch).","commonSituations":"Client authenticating with a credential registered to a different relying party ID or origin; replayed or stale challenge; authenticator counter regression (cloned token); user submitting an assertion for an unregistered credential; multiple CAS nodes with different RP IDs in config.","solutions":["Verify cas.authn.mfa.webauthn relying-party id / server origin exactly match the URL and domain the browser uses","Have the user re-register the authenticator (delete the stored credential registration) and retry","Check that the request challenge issued by startAuthentication is the one being answered, not a cached page","Confirm all CAS cluster nodes share the same WebAuthn configuration and credential registry","Enable DEBUG logging on com.yubico.core.WebAuthnServer to see the underlying AssertionFailedException detail"],"exampleFix":"// before: reusing a stale challenge page\nfinishAuthentication(oldRequest)\n// after: fetch a fresh assertion request, then finish\nval req = webAuthnServer.startAuthentication(username)\n// ...browser completes req...\nwebAuthnServer.finishAuthentication(newRequest)","handlingStrategy":"validation","validationCode":"if (webAuthnCredentialRepository.findByUsername(username) == null) throw new IllegalStateException(\"User has no registered WebAuthn credential\");","typeGuard":null,"tryCatchPattern":"var result = webAuthnServer.finishAuthentication(request);\nif (result.isLeft()) { /* show result.getLeft() to the user, offer re-registration */ }","preventionTips":["Keep RP id and origin identical across all CAS nodes and browser-facing URLs","Always answer the challenge from the current authentication session","Delete stale credential registrations after hardware token changes"],"tags":["webauthn","authentication","assertion-validation"],"backgroundTag":"authentication-required","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}