docs: note disabled-account failures during WebAuthn login verification

Clarify that provider WebAuthn login verification may reject disabled accounts with credential-style failures despite valid authenticator assertions.
2026-02-26 12:21:30 +00:00
parent cdef7da4b9
commit 8b7f11fc6a
1 changed files with 1 additions and 0 deletions
@@ -137,6 +137,7 @@ try {
 `UserInfoException` with `invalid_token` can occur when provider-side subject scope is no longer active (for example user/project disabled) between token issuance and userinfo retrieval.
 `TokenExchangeException` with `invalid_grant` can also occur when provider-side client/user/project state is inactive at exchange time.
 Provider login/authorization steps can also fail with `access_denied` when account status is disabled before completion.
+WebAuthn-based login verification can return credential-style failures for disabled accounts even when authenticator assertions are otherwise valid.

 ## Operational guidance