v0.3.1 — Security fix

Security fix

Fixed a critical unauthenticated passkey-registration vulnerability (GHSA-g4c6-hq9j-38x7). Passkey registration now requires an authenticated owner session.

All users should update to v0.3.1. If you suspect an unauthorized passkey was added before updating, review your registered passkeys and remove any you do not recognize.

Patched in commit 159bb62.

Thanks

Thank you to ucsurf for responsibly reporting the issue and providing a clear reproduction and remediation guidance. We appreciate your help improving MyAuthenticator security.

Full changelog

Compare v0.3...v0.3.1