{"record":{"id":"b84eb4cc28175946","repo":"nextauthjs/next-auth","slug":"webauthn-authentication-response-could-not-be-veri","errorCode":null,"errorMessage":"WebAuthn authentication response could not be verified","messagePattern":"WebAuthn authentication response could not be verified","errorType":"exception","errorClass":"WebAuthnVerificationError","httpStatus":null,"severity":"error","filePath":"packages/core/src/lib/utils/webauthn-utils.ts","lineNumber":264,"sourceCode":"  try {\n    const relayingParty = provider.getRelayingParty(options, request)\n    verification = await provider.simpleWebAuthn.verifyAuthenticationResponse({\n      ...provider.verifyAuthenticationOptions,\n      expectedChallenge,\n      response: data as AuthenticationResponseJSON,\n      authenticator: fromAdapterAuthenticator(authenticator),\n      expectedOrigin: relayingParty.origin,\n      expectedRPID: relayingParty.id,\n    })\n  } catch (e: any) {\n    throw new WebAuthnVerificationError(e)\n  }\n\n  const { verified, authenticationInfo } = verification\n\n  // Make sure the response was verified\n  if (!verified) {\n    throw new WebAuthnVerificationError(\n      \"WebAuthn authentication response could not be verified\"\n    )\n  }\n\n  // Update authenticator counter\n  try {\n    const { newCounter } = authenticationInfo\n    await adapter.updateAuthenticatorCounter(\n      authenticator.credentialID,\n      newCounter\n    )\n  } catch (e: any) {\n    throw new AdapterError(\n      `Failed to update authenticator counter. This may cause future authentication attempts to fail. ${JSON.stringify(\n        {\n          credentialID,\n          oldCounter: authenticator.counter,\n          newCounter: authenticationInfo.newCounter,","sourceCodeStart":246,"sourceCodeEnd":282,"githubUrl":"https://github.com/nextauthjs/next-auth/blob/a1a16a5a7780488c7449feece410033f445d0b31/packages/core/src/lib/utils/webauthn-utils.ts#L246-L282","documentation":"The @simplewebauthn/server verifyAuthenticationResponse returned verified:false, meaning the assertion failed cryptographic or challenge verification. The library wraps this as a WebAuthnVerificationError.","triggerScenarios":"verifyAuthenticate receives an assertion whose challenge does not match the stored cookie challenge, origin/rpID mismatch, wrong public key for the credential, or a tampered signature.","commonSituations":"rpID or origin misconfigured between environments (localhost vs production domain); challenge cookie expired or cleared before verification; multiple transports altering the assertion bytes; clock/session issues invalidating the stored challenge.","solutions":["Verify WebAuthnProvider rpID and origin match the domain the client used","Ensure the challenge cookie from startAuthentication still exists and matches at verify time","Confirm the authenticator record's publicKey matches the credential being used","Check @simplewebauthn/server version compatibility with the response format"],"exampleFix":"// before\nWebAuthnProvider({ id: \"example.com\" }) // client on localhost\n// after\nWebAuthnProvider({ id: \"localhost\", origin: \"http://localhost:3000\" })","handlingStrategy":"try-catch","validationCode":"// pre-check config consistency\nconsole.assert(provider.rpID === new URL(clientOrigin).hostname, 'rpID must match client origin')","typeGuard":null,"tryCatchPattern":"try {\n  await verifyAuthenticate(data)\n} catch (e) {\n  if (e instanceof WebAuthnVerificationError) {\n    // reject login, clear challenge cookie, log for security review\n    return new Response('Verification failed', { status: 401 })\n  }\n  throw e\n}","preventionTips":["Keep rpID and origin aligned with the deployment domain per environment","Never reuse or cache challenge cookies across ceremonies","Keep @simplewebauthn/server and the provider versions in sync","Monitor verification failures as potential clone/attack signals"],"tags":["webauthn","verification","signature","challenge"],"backgroundTag":"webauthn-verification-failed","analyzedSha":"a1a16a5a7780488c7449feece410033f445d0b31","analyzedAt":"2026-08-28T21:52:38.200Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}