Three branches (for EvidenceVerifyCallback, MechanismInformationCallback, CredentialUpdateCallback) in handleOne method of CallbackHandler created in ServerAuthenticationContext.createCallbackHandler() do not call handleOne(callbacks, idx + 1);, which means that another callbacks in array are not processed then. In case it is expected then some assertion that no another callback is obtained in callbacks array should be added.