Mad World

Song: https://www.youtube.com/watch?v=Hef-Zf6frk0

Passbolt 5.17.0 "Mad World" introduces passkeys for multi factor authentication, improves autofill reliability across websites, makes permission changes easier to review when moving resources, and brings PIN code resources to QuickAccess. This release also includes security fixes and performance improvements.

Passkeys for MFA

Passbolt 5.17 adds passkeys as a second authentication factor, alongside the TOTP, Yubikey OTP and Duo providers that are already supported. It answers a requirement that many organisations now include in their procurement processes: multi-factor authentication that resists phishing, which one-time codes cannot provide.

Built on the WebAuthn/FIDO2 standard, it is bound to the domain of the Passbolt instance, and the browser refuses to use it anywhere else, so a lookalike site has nothing to capture. Basically, one-time code can be typed into a fake login page and relayed to the real site by an attacker. Passkeys cannot be used this way and protects against this kind of phishing.

Passkeys are available in every edition. Once an administrator enables them in Administration > Multi-factor authentication, each user can register up to ten passkeys from Profile > Multi-factor authentication, using a security key such as a YubiKey or the biometrics built into their laptop, phone, such as Touch ID or Windows Hello.

From then on, Passbolt asks for the passkey right after sign-in, as it does for the other providers. Users can tick "Remember this device for a month" to skip the check on a trusted device, or leave it unticked to verify every time. Organisations using Passbolt Pro edition, and wanting a stricter posture can disable this option in the Multi-factor authentication policy settings, so that every sign-in requires the passkey.

This first step covers multi-factor authentication. Storing passkeys for third-party websites as a resource type and Passwordless sign-in to Passbolt will follow in upcoming releases.

A new autofill detection engine

Autofill is a core part of the Passbolt browser experience, and version 5.17 rebuilds its detection engine from scratch. It tackles two familiar frustrations: no autofill on a form that clearly needs it, and an autofill icon in a field that has nothing to do with credentials.

Getting this right is harder than it looks, because no two websites build their forms the same way. Field names differ, labels come in many languages, and the underlying code varies widely from one site to the next. A handful of regular expressions could only go so far, and the previous engine had reached its limits.

The new engine understands the context of each field, from the structure of the form to the labels around it, before deciding whether to step in. The first benchmarks are very promising: on our internal test set, form detection rises from 74% with the previous engine to 93.4%, while processing cost stays low.

A test set is not the web, though, and this is where the community comes in: we are eager to hear how the engine behaves on the websites our users rely on every day. For those curious about the inner workings, a detailed blog post will follow.

Safer permission handling during resource moves

Passbolt 5.17 brings the permission review introduced in 5.14 to moves of resources and folders. Creating a resource in a shared folder, editing a shared resource and now moving items all ask for the same explicit confirmation.

A move needs this step because placing a resource in a shared folder, or taking it out of one, can change who has access to it. Previously, users chose between keeping the current permissions and applying those of the destination folder, without seeing what either option would produce. Getting it right meant anticipating the outcome, which could be confusing.

From this version, every move follows the destination folder strategy: permissions inherited from the origin parent folder are removed, and those of the destination folder take their place. Before saving, Passbolt shows who will gain, lose or keep access, and this proposal can be refined with the usual granular control, one user or group at a time. Nothing changes until the user confirms, and the operation can still be cancelled.

Access PIN Codes through QuickAccess

This release brings PIN codes to QuickAccess. Users no longer need to switch to the web workspace to retrieve door codes or device PINs.

PIN codes also inherit offline availability, using the same security and synchronization controls as other secrets, as described in the Offline Mode blog post.

This is part of a broader effort to expand QuickAccess and Offline Mode support to all remaining resource types in upcoming releases.

Large organization group management performance

The release also tackles one of the most requested improvements on adding a user to a large group with many shared resources. This operation is now more than twice as fast and is achieved through optimizing the underlying database queries. This cuts the wall time for adding a user to a group having access to 300 resources from 1.19 seconds to 514 milliseconds. Now, administrators can spend less time waiting when onboarding users or reorganizing access in large groups with many shared resources.

Security Improvements

Passbolt 5.17.0 brings targeted security improvements and hardening measures resulting from internal assessments and external research.

• Safer Cookie Handling in Safari: Cookie management within the Safari extension is strengthened following insights from the recent Cure53 audit. Cookies are now more strictly isolated preventing them from being unintentionally exposed to other hosts

• Clipboard Auto-Clear Protection: Thanks to a report from external researcher Alex J, an edge case has been fixed where a malicious website could intercept, copy or cut events to cancel the clipboard-clearing timer. Copied secrets are now reliably cleared from the clipboard as intended.

• SCIM Token Enforcement (Pro Edition): Expired SCIM bearer tokens are now strictly rejected to prevent unauthorized ongoing access to provisioning endpoints. Administrators also receive proactive health checks and daily notifications, when the token is used and nearing expiration.

A dedicated security bulletin will be published soon. It will provide more details on each of the resolved issues, including their potential impact and how they were addressed.

Updating to Passbolt 5.17.0 is recommended to benefit from these security improvements.

Conclusion

Many thanks to everyone who provided feedback, reported bugs and contributed to making Passbolt better.

Changelog

Added

• PB-53318 As a user I can add passkeys as multifactor authentication provider
• PB-54953 As a user I can use passkeys as multifactor authenticator from the Passbolt mobile app
• PB-39607 As an administrator I can cleanup soft-delete active resources that no longer have an associated secret
• PB-54494 As an administrator I can configure SCIM admin token expiry and the near-expiry window
• PB-54498 Adds a healthcheck warning administrators when a SCIM admin token is nearing expiry
• PB-54499 As an administrator I get notified by email when a SCIM admin token is near expiry or has expired
• PB-55263 Adds an "Is encrypted for its recipient" data check in secrets

Fixed

• PB-54495 Adds a ScimTokenExpiryChecker service to compute SCIM admin token expiry state
• PB-54496 Rejects SCIM requests presenting an expired admin token at authentication time
• PB-54497 Adds a ScimUnauthenticatedResponseMiddleware returning a structured 401 payload on SCIM auth failure
• PB-53970 Flushes all users' MFA settings when an administrator disables MFA for the organization
• PB-54696 Shortens the TTL of mfa_setup and mfa_verify authentication tokens
• PB-54701 Enforces one active MFA ceremony handle per user
• PB-54828 Fixes a null type value in the ResourceTypes slug definition
• PB-54830 Adds an index on the users.username column to speed up user lookups
• PB-54831 Adds a composite index on scim_entries(scim_name, foreign_model) to speed up SCIM lookups
• PB-54832 Adds a retry loop to UserScimResource::create() to withstand concurrent SCIM writes
• PB-54833 Maps 500 responses from the SCIM endpoint to 429 with a Retry-After header on concurrency conflicts
• PB-54856 Reduces the number of queries inside the loop in FoldersRelationsSortService
• PB-54857 Adds a limit to isItemPersonal() when checking if an item is personal
• PB-54858 Improves setSecretRevisionInData() to not search the full collection each time
• PB-54980 Fixes the wrong CTA URL in offline mode emails
• PB-54990 Deactivates all authentication tokens on user soft-delete
• PB-55138 Reduces PASSBOLT_AUTH_JWT_REFRESH_TOKEN expiry to 1 hour

Security

• PB-53564 Excludes authentication tokens from the SQL dump command
• PB-54638 Fixes blind SSRF via avatar upload (AL-02)
• PB-54640 Fixes MFA brute-force limiter not counting failed TOTP codes submitted to the JSON endpoint (AL-01)
• PB-54703 Fixes SSRF egress guard bypass in SSO provider URL validation (AS-01)
• PB-55268 Fixes braces security vulnerability GHSA-vfj7-8cjw-p6xm (CVSS 3.1 HIGH)