From 4c8efddf756120b1aeb4ef69febbfba4f086c815 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jonathan=20Guti=C3=A9rrez?= <contacto@jgutierrez.cl>
Date: Wed, 9 Jul 2025 15:59:38 +0000
Subject: [PATCH] WebAuthn: Avoid submitting the wrong form

If the template is modified/overridden, there could be other forms before the two-factor one. This selects the form based on the tokenField input.
---
 .../webauthn/templates/two_factor_webauthn/create_credential.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/two_factor/plugins/webauthn/templates/two_factor_webauthn/create_credential.js b/two_factor/plugins/webauthn/templates/two_factor_webauthn/create_credential.js
index 4acb5c7e8..3c03e997f 100644
--- a/two_factor/plugins/webauthn/templates/two_factor_webauthn/create_credential.js
+++ b/two_factor/plugins/webauthn/templates/two_factor_webauthn/create_credential.js
@@ -20,7 +20,7 @@ navigator.credentials.create({
             type: attestationCredential.type,
         },
         tokenField = document.querySelector('[name=webauthn-token]'),
-        form = document.forms[0];
+        form = tokenField.closest('form');
 
     tokenField.value = JSON.stringify(serializableAttestationCredential);
     form.submit();