CVE-2026-64866

Name of the Vulnerable Software and Affected Versions New API versions 0.9.1.3 through 1.0.0-rc.6

Description An authorization flaw exists in the AdminResetPasskey function within controller/passkey.go. The endpoint DELETE /api/user/:id/reset passkey fails to implement the canManageTargetRole check, which is used by other privileged account-protection endpoints. This allows a lower-privileged administrator to remove a passkey from accounts with the same or higher privilege levels, including root accounts, thereby weakening the target account's authentication security.

Recommendations Update to version 1.0.0-rc.7. As a temporary workaround, restrict admin access to trusted operators and block the DELETE /api/user/:id/reset passkey endpoint at the reverse proxy or gateway for all users except root operators.