Onetime Secret v0.26.19 closes a passkey account takeover
18 minutes ago
If you run Onetime Secret in full mode with passkeys on, install this release promptly. Version 0.26.19 closes a passkey sign-in hole that let one account take over another, and it changes a few things worth preparing for.
Ask about this presentation
Chapters
Show transcriptHide transcript
If you run Onetime Secret in full mode with passkeys on, install this release promptly. Version 0.26.19 closes a passkey sign-in hole that let one account take over another, and it changes a few things worth preparing for.
Slide text
onetimesecret/onetimesecret · release v0.26.19Onetime Secret v0.26.19 closes a passkey account takeover
Upgrade promptly if you run full mode with passkeys on.
Through 0.26.18, a session that was already signed in could use passkey login to sign in as any other account. This release moves to Rodauth 2.48, and the sign-in routes now refuse a signed-in session. Until you can upgrade, set AUTH_WEBAUTHN_ENABLED to false. Passkey-only accounts then use a magic link or a password reset.
Your users will notice that fix. A signed-in user who opens a verify or magic link now gets a 403, Already logged in. Signing out, or a private window, clears it. And open tabs reload once, the first time they navigate after the deploy, because routes and languages now load as separate chunks.
In full mode, before you deploy, export the authentication audit log. Closing an account now deletes its accounts row and its audit rows together, with no setting to keep them. That table, with your request logs, is also the evidence if you choose to review past passkey sign-ins.
If scripts call bin/ots, check them. These are the old forms. Many writes now only preview until you add the apply flag, so check each command's help; add-member moves to memberships add, and the organizations check becomes doctor all. A piped yes now only previews, and still exits zero.
For API clients, every burn endpoint now returns the receipt after the burn. If the receipt expires mid-request, you get a 404. Once the secret is gone, the share path and share URL are null, and the secret identifier is left out. And version one stops returning a guest's secret key to the receipt holder.
Custom domains get three opt-in controls, each behind an entitlement. Network rules limit anonymous secret creation by IP range. secrets.acme.com can admit sign-ups from acme.com. SAML settings fill from a metadata URL. And SAML now rejects an entity ID with a placeholder, so replace it with your real one.
If expiration warnings are on and you run the job system, those emails now get delivered, with a working link. Once every 0.26.18 process has stopped, delete the retired schedule queue. Simple-mode email verification also works from the emailed link now, without a session.
So, in order. Export the audit log. Add the apply flag to your scripts. Deploy. Cleanup can wait, and pruning closed accounts deletes audit rows too, so run it only after the export and after you've decided about reviewing passkey sign-ins.
To roll back, pin 0.26.18; no migration ran. But turn passkeys off first, because that version is still exposed. Deleted auth rows stay deleted, and a restricted homepage is public until you return. The upgrade guide has the details. Version 0.26.19 closes the passkey account takeover.