Version 2.9.0

webauthn-server-core:

Security fixes:

• Fixed issue where RelyingParty.finishAssertion and RelyingPartyV2.finishAssertion could return a successful authentication result even though the authenticated credential is owned by a different user than StartAssertionOptions.username. For details see YSA-2026-02: https://www.yubico.com/support/security-advisories/ysa-2026-02/
  • This fix is forward-ported from version 2.8.2 since the issue is also present in pre-release 2.9.0-alpha1.

Fixes:

• Added @since tags to AttestationTrustSource javadoc.

webauthn-server-attestation:

Changes:

• FidoMetadataDownloader builder method .downloadBlob(URL) now logs a warning if the given URL is not an HTTPS URL. Javadoc relaxed to not describe HTTPS as required since this was never enforced.

New features:

• Added AuthenticatorStatus.RETIRED and Filters.notRetired().
• Added AttachmentHint.ATTACHMENT_HINT_SMART_CARD.
  • Thanks to Misagh Moayyed and Erlend Nukke for the contribution, see #468 and #467
• Added UNKNOWN constant to all enums in com.yubico.fido.metadata:
  • AttachmentHint
  • AuthenticationAlgorithm
  • AuthenticatorAttestationType
  • CtapCertificationId
  • CtapPinUvAuthProtocolVersion
  • CtapVersion
  • ProtocolFamily
  • PublicKeyRepresentationFormat
  • TransactionConfirmationDisplayType
• Added enum constant CtapVersion.FIDO_2_3.
• Added missing fields to FIDO MDS data model:
  • AuthenticatorGetInfo: attestationFormats, longTouchForReset, uvCountSinceLastPinEntry, transportsForReset, pinComplexityPolicy, pinComplexityPolicyURL, maxPINLength, authenticatorConfigCommands
  • BiometricAccuracyDescriptor: iAPARThreshold
  • MetadataStatement: friendlyNames, iconDark, providerLogoLight, providerLogoDark, keyScope, multiDeviceCredentialSupport, cxpConfigURL
  • StatusReport: certificationProfiles, sunsetDate, fipsRevision, fipsPhysicalSecurityLevel
• FidoMetadataDownloader now sends the If-None-Match request header set to the "no" of the cached BLOB, if any, and handles 304 Not Modified responses appropriately.
• In FidoMetadataDownloader if a BLOB download request returns an HTTP failure status, but returns an ETag response header matching the "no" of the cached BLOB, if any, this is now interpreted like a successful 304 Not Modified response.
• Added .cachePolicy setting to FidoMetadataDownloader to allow dynamically opting out of falling back to cache when a BLOB download fails.

Fixes:

• Added @since tags to AuthenticatorStatus and FidoMetadataService javadoc.
• All com.yubico.fido.metadata enums now deserialize unknown values to UNKOWN instead of crashing the parser.

Artifacts built with openjdk version "17.0.18" 2026-01-20.

Version 2.8.2

Security fixes:

• Fixed issue where RelyingParty.finishAssertion and RelyingPartyV2.finishAssertion could return a successful authentication result even though the authenticated credential is owned by a different user than StartAssertionOptions.username. For details see YSA-2026-02: https://www.yubico.com/support/security-advisories/ysa-2026-02/

Artifacts built with openjdk version "17.0.18" 2026-01-20.

Experimental release 2.9.0-alpha1

webauthn-server-core:

Fixes:

• Added @since tags to AttestationTrustSource javadoc.

webauthn-server-attestation:

New features:

• Added AuthenticatorStatus.RETIRED and Filters.notRetired().
• Added AttachmentHint.ATTACHMENT_HINT_SMART_CARD.
  • Thanks to GitHub users mmoayyed and ErlendNukke for the contribution, see #468 and #467
• Added UNKNOWN constant to all enums in com.yubico.fido.metadata:
  • AttachmentHint
  • AuthenticationAlgorithm
  • AuthenticatorAttestationType
  • CtapCertificationId
  • CtapPinUvAuthProtocolVersion
  • CtapVersion
  • ProtocolFamily
  • PublicKeyRepresentationFormat
  • TransactionConfirmationDisplayType
• Added enum constant CtapVersion.FIDO_2_3.
• Added missing fields to FIDO MDS data model:
  • AuthenticatorGetInfo: attestationFormats, longTouchForReset, uvCountSinceLastPinEntry, transportsForReset, pinComplexityPolicy, pinComplexityPolicyURL, maxPINLength, authenticatorConfigCommands
  • BiometricAccuracyDescriptor: iAPARThreshold
  • MetadataStatement: friendlyNames, iconDark, providerLogoLight, providerLogoDark, keyScope, multiDeviceCredentialSupport, cxpConfigURL
  • StatusReport: certificationProfiles, sunsetDate, fipsRevision, fipsPhysicalSecurityLevel

Fixes:

• Added @since tags to AuthenticatorStatus and FidoMetadataService javadoc.
• All com.yubico.fido.metadata enums now deserialize unknown values to UNKOWN instead of crashing the parser.

Artifacts built with openjdk version "17.0.18" 2026-01-20.

Version 2.8.1

Fixes:

• Relaxed Guava dependency version constraint to include major version 33.

Artifacts built with openjdk version "17.0.17" 2025-10-21.

Version 2.8.0

New features:

• Added JavaDoc to COSEAlgorithmIdentifier constants.
• Added support for Ed448 signatures.
• New constants COSEAlgorithmIdentifier.Ed25519, COSEAlgorithmIdentifier.Ed448 and PublicKeyCredentialParameters.Ed448
• (Experimental) Added a new suite of interfaces, starting with CredentialRepositoryV2. RelyingParty can now be configured with a CredentialRepositoryV2 instance instead of a CredentialRepository instance. This changes the result of the RelyingParty builder to RelyingPartyV2. CredentialRepositoryV2 and RelyingPartyV2 enable a suite of new features:
  • CredentialRepositoryV2 does not assume that the application has usernames, instead username support is modular. In addition to the CredentialRepositoryV2, RelyingPartyV2 can be optionally configured with a UsernameRepository as well. If a UsernameRepository is not set, then RelyingPartyV2.startAssertion(StartAssertionOptions) will fail at runtime if StartAssertionOptions.username is set.
  • CredentialRepositoryV2 uses a new interface CredentialRecord to represent registered credentials, instead of the concrete RegisteredCredential class (although RegisteredCredential also implements CredentialRecord). This provides implementations greater flexibility while also automating the type conversion to PublicKeyCredentialDescriptor needed in startRegistration() and startAssertion().
  • RelyingPartyV2.finishAssertion() returns a new type AssertionResultV2 with a new method getCredential(), which returns the CredentialRecord that was verified. The return type of getCredential() is generic and preserves the concrete type of CredentialRecord returned by the CredentialRepositoryV2 implementation.
  • NOTE: Experimental features may receive breaking changes without a major version increase.
• (Experimental) Added property RegisteredCredential.transports.
  • NOTE: Experimental features may receive breaking changes without a major version increase.

webauthn-server-attestation:

New features:

• Updated SupportedCtapOptions to version 2.2 of CTAP spec.
  • New field perCredMgmtRO

Fixes:

• Fixed parsing logic of tri-valued Boolean SupportedCtapOptions properties. See: #382

Artifacts built with openjdk 17.0.15 2025-04-15.

Note: Artifacts are signed by a new key. See Yubico Software Signing.

Pre-release 2.8.0-RC1

Changes since 2.8.0-alpha3

webauthn-server-core:

New features:

• Added JavaDoc to COSEAlgorithmIdentifier constants.
• Added support for Ed448 signatures.
• New constants COSEAlgorithmIdentifier.Ed25519, COSEAlgorithmIdentifier.Ed448 and PublicKeyCredentialParameters.Ed448

webauthn-server-attestation:

New features:

• Updated SupportedCtapOptions to version 2.2 of CTAP spec.
  • New field perCredMgmtRO

Fixes:

• Fixed parsing logic of tri-valued Boolean SupportedCtapOptions properties. See: #382

Changes since 2.7.0

webauthn-server-core:

New features:

• (Experimental) Added a new suite of interfaces, starting withCredentialRepositoryV2. RelyingParty can now be configured with a CredentialRepositoryV2 instance instead of a CredentialRepository instance. This changes the result of the RelyingParty builder to RelyingPartyV2. CredentialRepositoryV2 and RelyingPartyV2 enable a suite of new features:
  • CredentialRepositoryV2 does not assume that the application has usernames, instead username support is modular. In addition to the CredentialRepositoryV2, RelyingPartyV2 can be optionally configured with a UsernameRepository as well. If a UsernameRepository is not set, then RelyingPartyV2.startAssertion(StartAssertionOptions) will fail at runtime if StartAssertionOptions.username is set.
  • CredentialRepositoryV2 uses a new interface CredentialRecord to represent registered credentials, instead of the concrete RegisteredCredential class (although RegisteredCredential also implements CredentialRecord). This provides implementations greater flexibility while also automating the type conversion to PublicKeyCredentialDescriptor needed in startRegistration() and startAssertion().
  • RelyingPartyV2.finishAssertion() returns a new type AssertionResultV2 with a new method getCredential(), which returns the CredentialRecord that was verified. The return type of getCredential() is generic and preserves the concrete type of CredentialRecord returned by the CredentialRepositoryV2 implementation.
  • NOTE: Experimental features may receive breaking changes without a major version increase.
• (Experimental) Added property RegisteredCredential.transports.
  • NOTE: Experimental features may receive breaking changes without a major version increase.

Artifacts built with openjdk version "17.0.15" 2025-04-15.

Note: Artifacts are signed by a new key. See Yubico Software Signing.

Version 2.7.0

New features:

• Added overloaded setter RelyingPartyBuilder.origins(Optional<Set<String>>).
• Added support for the CTAP2 credProtect extension.
• Added support for the prf extension.
• (Experimental) Added option FinishRegistrationOptions.isConditionalCreate to allow UP=0 in registration response for registration ceremonies with mediation: "conditional".
  • NOTE: Experimental features may receive breaking changes without a major version increase.

Fixes:

• Excluded CVE-2025-27820 vulnerable versions of Apache httpclient5 from dependency resolution. Note that this might only affect consumers using Gradle module metadata.

Artifacts built with openjdk version "17.0.15" 2025-04-15.

Experimental release 2.8.0-alpha3

Ported changes from pre-release 2.7.0-RC3:

Fixes:

• Excluded CVE-2025-27820 vulnerable versions of Apache httpclient5 from dependency resolution. Note that this might only affect consumers using Gradle module metadata.

Artifacts built with openjdk version "17.0.15" 2025-04-15.

Pre-release 2.7.0-RC3

Fixes:

• Excluded CVE-2025-27820 vulnerable versions of Apache httpclient5 from dependency resolution. Note that this might only affect consumers using Gradle module metadata.

Artifacts built with openjdk version "17.0.15" 2025-04-15.

Experimental release 2.8.0-alpha2

Ported changes from pre-release 2.7.0-RC2:

Fixes:

• Fixed JSON encoding of credProtect extension inputs.

Artifacts built with openjdk version "17.0.14" 2025-01-21.