The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames

return $this->publicKeyCredentialRequestOptionsFactory->create(
            $this->profile,
            count($allowedCredentials) <= 0 ? self::getRandomCredentials(): $allowedCredentials,
            $optionsRequest->userVerification,
            $extensions
);

private static function getRandomCredentials(): array
{
        $credentialSources = [];
        for ($i = 0; $i <= rand(0,1); $i++) {
            $credentialSources[] = new PublicKeyCredentialSource(
                random_bytes(32),
                "public-key",
                [],
                "basic",
                new EmptyTrustPath(),
                Uuid::v7(),
                random_bytes(77),
                Uuid::v7()->__toString(),
                rand(0, 6000),
                null
            );
        }
        return array_map(
            static fn (PublicKeyCredentialSource $credential): PublicKeyCredentialDescriptor => $credential->getPublicKeyCredentialDescriptor(),
            $credentialSources
        );
}