Passkey implementation probably implemented wrong

[frokoloko]

Hi, I tried to to log on with my passkey now. And to my surprise, it worked without me writing any password or otherwise authenticating me. This should not be possible with passkey. Might be a security vulnerability

 

[frokoloko]

Follow up: realized authentication locally isn't required. But still; for a site like this it probably should be enforced, no?