Forge a software WebAuthn authenticator (attestation: none)

When it applies

• The app authenticates with WebAuthn/FIDO2 (register + authenticate "ceremonies", navigator.credentials.create/get, client bundles calling /register/begin,/register/finish,/auth/begin,/auth/finish).
• register/begin returns creation options with "attestation":"none" (or the RP never validates the attestation certificate chain). None-attestation means the server does NOT check that a real hardware authenticator vouched for the key — so a key you generate in software is accepted.
• You can start registration: either registration is open, or you can leak an invite/enrollment token (see tech-mongo-agg-facet-bypass and NoSQL-injection notes).

Why it works

WebAuthn security rests on the authenticator signing a server challenge with a private key. With attestation:none, the server trusts whatever public key the client submits at register/finish (no proof it came from a certified device). You therefore generate your own keypair, register its public key, then at auth/finish sign the server's challenge with the matching private key — a completely valid assertion, because it is your key.