The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames
The ProfileBasedRequestOptionsBuilder method returns allowedCredentials without any credentials if no username was found.
Advisories for Composer/Web-Auth/Webauthn-Lib package
2024