Skip to main content
Version: 11.5.0

11.5.0 Release Notes

HYPR 11.5.0 is an Enterprise Channel Release.

The Enterprise Release Channel follows a quarterly upgrade cycle, ensuring a stable and predictable update process. This schedule provides organizations with ample time to test, adapt, and implement changes while minimizing disruptions to business operations. With each release, customers receive the latest security, performance, and feature enhancements, allowing them to stay up to date with improvements while maintaining operational stability.

Looking for the full history?

The per-item record for this release and every prior release is maintained in the Changelog.

Minimum Supported Versions​

Release DateHYPR ProductMinimum RequirementNotes
October 20HYPR Passwordless for Windows 11.5.0Windows (10 "2004", 11)
Windows 11 on ARM		Reboot required if upgrading from 7.6 or below; Security Key Support for YubiKey 5 Series with firmware 5.X, YubiKey Bio Multi-Protocol Edition, IDEMIA ID-One on Cosmo 8.2, Feitian K9 Plus and K40 Plus and its offshoots; for Windows 11 on ARM, download the ARM64 installer from the Desktop Client tab in Control Center
October 20HYPR Passwordless for Mac 11.5.0macOS (Big Sur 11.5 [not 11.0–11.4], Monterey, Ventura, Sonoma 14.1 [not 14.0], Sequoia, Tahoe, Golden Gate)Security Key Support for YubiKey 5 Series with firmware 5.X and Feitian ePass K9 Plus, K40 Plus and their respective offshoots; see the Changelog for known issues on macOS 27 (Golden Gate)
October 20HYPR Mobile App for Android 11.5.0Android 9.0+Passkey operations require Android 14 or later
October 6HYPR Mobile App for iOS 11.3.5iOS 12.4+The HYPR Mobile App for iOS 11.5.0 releases at a later date; see Breaking Changes
October 20HYPR Server 11.5.0Java Development Kit (JDK) 17Upgrade to 7.10 required before upgrading to 8.0.0 or higher
October 20HYPR SDK for Android 11.5.0Android 9.0+
August 19HYPR SDK for iOS 11.3.2iOS 12.4+The HYPR SDK for iOS 11.5.0 releases at a later date; see Breaking Changes
October 20HYPR SDK for Java 11.5.0Java Development Kit (JDK) 17+
Backward Compatibility

All HYPR components are fully compatible across the three previous/subsequent minor (X.X) HYPR releases.

Breaking Changes​

  • [HYPR Mobile App for iOS] The HYPR Mobile App for iOS 11.5.0 and the HYPR SDK for iOS 11.5.0 ship separately from the rest of the 11.5.0 components and release at a later date. Until the 11.5.0 build is available in the App Store, continue using your currently deployed iOS app version.

  • [Integrations] The HYPR Authenticator (Legacy) and HYPR Registrator are no longer included with Keycloak, and an upgrade does not move integrations off them. Integrations that still use either one must move to the modular HYPR authenticators before upgrading to 11.5.0. Contact HYPR Support to plan the move.

HYPR Affirm​

Identity Verification With Document Issuer

In 11.5.0, the Identity Verification With Document Issuer check (BETA) in Document and Biometric Verification supports a limited set of countries. Support for more countries is planned.

Enhancements​

▸ Document checks held for manual review​

When the identity verification provider holds a document and biometric check for its own manual review and no decision arrives within 10 minutes, Affirm now ends the step under a dedicated default rule, IDV Outcome Fail — Awaiting Manual Review. The step fails by default; administrators can set the rule to escalate these verifications to a reviewer instead. In the Activity Log, the verification shows as Unverified, with each held check marked Awaiting manual review. A hold is not a rejection: once the provider completes its review, the requester can start a new verification, which can then pass. See Checks Held for Manual Review.

▸ Identity flags in verification details​

Verification details in the Activity Log and Helpdesk now show whether the requester's directory profile already held the details the identity checks need, or the requester had to enter them, and whether the document's identity was found in the data sources of the enhanced identity check. See Activity Log details view.

HYPR Adapt​

New Features​

▸ Restrict web application login to managed workstations​

The new Managed Machine Login risk policy template allows login to a web application only from workstations that HYPRspeed (Desktop SSO) verifies as managed. Logins from other workstations and from mobile browsers are blocked. On a computer, the blocked page directs users to sign in to their computer with HYPR and try again; on a phone or tablet, it explains that sign-in is allowed only from a managed computer. Administrators can grant a user a temporary exception, and can run the policy in logging-only mode to see which logins it would block before enforcing it. See Risk Policy Template: Managed Machine Login.

HYPR Control Center​

New Features​

▸ View and download client logs in Control Center​

A new Logs tab lists the diagnostic logs that HYPR Mobile App devices and workstations upload. Administrators can search by user, device, machine or app version, filter by client type and time range, and download the logs for one client or several at once as a .zip file. The tab is in Control Center Settings in Standard Mode and in Server Settings in Advanced Mode, and requires the Admin role. See Logs.

Enhancements​

▸ HYPR Link available in Standard Mode​

When HYPR Links are enabled for your tenant, the magic link windows in Standard Mode now show the HYPR Link alongside the other links, so administrators no longer need to switch to Advanced Mode to copy it. See HYPR Link.

▸ FIDO metadata trust and authenticator data updated​

Control Center now trusts the GlobalSign Root R46 certificate that the FIDO Alliance uses to sign the FIDO Metadata Service (MDS) data, so metadata downloads continue to validate after the FIDO Alliance's root certificate change. The authenticator metadata bundled with Control Center is also refreshed. No action is required. See FIDO2 MDS Server.

HYPR Passwordless for Windows​

Enhancements​

▸ ARM-based Windows workstations generally available​

HYPR Passwordless for Windows is generally available for ARM-based (ARM64) workstations. Administrators download the ARM64 installer from a dedicated button on the Desktop Client tab in Control Center, instead of requesting it from HYPR Support, and ARM64 workstations running the 11.5 client or later receive ARM64 builds when they upgrade automatically. See Client Download.

▸ FIDO2 security key provisioning for Entra ID generally available​

FIDO2 Security Key Provisioning for Entra ID, a Preview since 10.7.0, is generally available. On Entra-joined workstations, users pair a FIDO2 security key or smart card in HYPR Passwordless for Windows, which provisions a FIDO2 credential into Microsoft Entra ID that works for both HYPR authentication and Entra ID sign-in. See FIDO2 Security Key Provisioning for Entra ID.

HYPR Mobile App​

New Features​

▸ Unlock a workstation by tapping an NFC tag​

Users can set up a blank NFC sticker from the HYPR Mobile App for iOS or Android and tap their phone against it to start unlocking their default workstation, without opening the app first. The tag holds only a fixed HYPR link and no credentials, so the unlock still requires the usual authentication. See Unlock with an NFC Tag.

Enhancements​

▸ Certificate pinning no longer enforced​

The HYPR Mobile App and the HYPR SDKs for Android and iOS validate the server with standard TLS trust validation and no longer enforce certificate pinning. SSL Pinning certificates configured in Control Center continue to apply to workstation clients. No action is required. See SSL Pinning for the end-of-support timeline.

For HYPR SDK for iOS integrators, the pinning methods are removed from HYPRBaseClient (initWithSSLPinningConfiguration:host:, initWithSSLPinningConfiguration:host:customHeadersAdapter: and setSSLPinningEnabled:), and the HYPRFeaturesManager refresh methods no longer take an sslPinningEnabled: parameter. +[HYPRUserAgent setSSLPinningEnabled:] remains but is deprecated and has no effect, and the rpSSLPinCredentials property of HYPRUserAgentProfileConfiguration is no longer used. Remove these calls when you update to the 11.5 SDK.

Integrations​

Enhancements​

▸ Keycloak integrations use the modular HYPR authenticators only​

Keycloak-based integrations sign users in through the modular HYPR authenticators; see Breaking Changes. When HYPRspeed (Desktop SSO) runs first, the username from the inbound SAML or OIDC request is carried over to the username step.

Events​

The following events were added in this release:

  • AFFIRM_WORKFLOW_DOCUMENT_BIOMETRIC_MANUAL_REVIEW (IDENTITY_VERIFICATION) — the identity verification provider flagged a document and biometric check for manual review.
  • AFFIRM_WORKFLOW_EXTENDED_INFO_MISMATCHED (IDENTITY_VERIFICATION) — the requester's date of birth or address from the user directory is missing or invalid, so the requester is asked for it. The message names the fields, not their values.

To see all HYPR events, see Audit Trail Event Descriptions.

Error Messages​

The following error codes were added in this release:

  • 1202808: SSRF_BLOCKED_TARGET — The requested destination host is not permitted for this configuration. Use a publicly resolvable external hostname.
  • 1202809: LOG_DOWNLOAD_TOO_LARGE — The requested log download exceeds the file-count or size limit. Narrow the time range or select fewer rows, then try again.
  • 1202811: ONBOARDING_INSTALLER_ARCHITECTURE_NOT_AVAILABLE — The HYPR Passwordless installer is not available for the requested architecture. Try again later, or contact HYPR Support if the issue persists.
  • 113098 (Android): HYPR_DISPLAY_CODE_FC_OPMANBASE_SENDRES_ASMINTENT_INCOMPLETE — Internal SDK error. Try again; check the logs for more details.
  • 114968 (Android): HYPR_DISPLAY_CODE_CPA_KEY_INVALIDATED — The device's security settings changed and the passkey can no longer be used. Register the passkey again.
  • 114969 (Android): HYPR_DISPLAY_CODE_CPA_VERIFICATION_REQUIRED — The passkey requires a recent user verification. Verify again and retry.
  • 1111021 (Android): HYPR_DISPLAY_CODE_BIOMETRICPROMPT_WEAK_NOT_SUPPORTED — The device's only enrolled biometric is too weak to protect passkeys. Enroll a stronger biometric or use another device.
  • 107244 (iOS): HYPRErrorPINAuthenticatorVerificationFailed — The PIN was rejected, or the PIN prompt was closed after a failed attempt. Try again.
  • 1010012 (iOS): HYPRErrorKeyAgreementLoginCertNotFound — The login certificate for certificate-based login was not found. Try again or contact HYPR Support.

To see all HYPR errors by component, see HYPR Error Codes Troubleshooting Table.

APIs​

The following endpoint was removed in this release:

  • POST /rp/api/certificate/reenroll — manually triggered certificate re-enrollment by serial number.

You can find detailed descriptors and other API calls in HYPR's full Postman API set here.

Bug Fixes and Known Issues​

Bug fixes and known issues for this release are recorded in the Changelog.