gravitational/teleport · error

all MFA devices failed

Error message

all MFA devices failed

What it means

runOnFIDO2Devices waits for a result from every connected MFA device; this sentinel is returned only when the loop exhausts all devices without producing a usable result — in practice because every device reported libfido2.ErrKeepaliveCancel or a nonInteractiveError, which are deliberately skipped.

Source

Thrown at lib/auth/webauthncli/fido2.go:727

	// First "interactive" response wins.
	for receiveCount < devices.len() {
		select {
		case err := <-devicesC:
			receiveCount++

			// Keep going on cancels or non-interactive errors.
			if errors.Is(err, libfido2.ErrKeepaliveCancel) || errors.Is(err, &nonInteractiveError{}) {
				fidoLog.DebugContext(ctx, "Got cancel or non-interactive device error", "error", err)
				continue
			}

			return trace.Wrap(err)

		case <-ctx.Done():
			return trace.Wrap(ctx.Err())
		}
	}
	return trace.Wrap(errors.New("all MFA devices failed"))
}

func startDevices(
	locs []*libfido2.DeviceLocation,
	filter deviceFilterFunc,
	deviceCallback deviceCallbackFunc,
	prompt runPrompt,
) (devices *openedDevices, devicesC <-chan error, err error) {
	fidoDevs := make([]FIDODevice, 0, len(locs))
	openDevs := make([]*openedDevice, 0, len(locs))

	// closeAll should only be used until the devices are handed over.
	// Do not defer-call it.
	closeAll := func() {
		for i, dev := range fidoDevs {
			path := openDevs[i].path
			err := dev.Close()
			fidoLog.DebugContext(context.Background(), "Close device",

View on GitHub (pinned to 1283425b60)

Solutions

1. Tap the security key when prompted instead of cancelling/retrying
2. If a non-interactive device (e.g. a platform authenticator in a headless flow) keeps failing, unplug it or use a device filter
3. Retry the login or registration

When it happens

Trigger: Thrown at lib/auth/webauthncli/fido2.go:727 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/3ca239b26283b445. Report an issue: GitHub.