Version: 11.3.0

Changelog

Entries are in timeline order by date, going backwards in time down the page.

11.3.6 - Patch 2026-09-23

Features & Enhancements

[Control Center] The list of public-key algorithms HYPR offers when a passkey is registered can now be narrowed for an individual application. The default list is unchanged, and the narrowed list governs both what HYPR offers and what it accepts. Contact HYPR Support to configure it.

Bug Fixes

[Affirm] Fixed the requester's full email address being shown at the phone or email verification step. The address is now masked, leaving only the first and last characters of the part before the @.
[Control Center] Fixed Desktop SSO failing for Microsoft Entra ID users whose user principal name contains uppercase letters, which sent those users to full authentication instead.

Known Issues

[HYPR Passwordless for Mac] On macOS 27, registering a mobile device or a smart card with HYPR Passwordless for Mac can fail with an error that the login keychain unlock key could not be stored.
[HYPR Passwordless for Mac] On macOS 27, unlocking a Mac at the lock screen with HYPR Passwordless may not work: the HYPR prompt may not appear, or the Mac may lock again immediately after it is unlocked.

11.3.5 - Patch 2026-09-17

Features & Enhancements

[Control Center] The OAuth client credentials token exchange now accepts a client assertion that omits the iat or jti claim, both optional under RFC 7523. Assertions that include them are validated as before, an assertion is still accepted only once, and exp remains required.
[Control Center] The maximum lifetime accepted on an OAuth client assertion is one hour by default and can be raised where an identity provider cannot issue assertions inside it. The setting applies to every OAuth client on the tenant. Contact HYPR Support to change it.
[Affirm] Added the AFFIRM_WORKFLOW_LOCATION_CLIENT_DATA_RETRIEVED and AFFIRM_WORKFLOW_LOCATION_IP_DATA_RETRIEVED audit events, recording where a verification's location data came from.

Bug Fixes

[Affirm] Fixed the issuing country list overlapping page content when a different country was selected during document verification.
[Affirm] Fixed a verification flow configured with only an AML check or only an OFAC check failing every applicant.
[Affirm] Fixed entering a phone number that did not match the number on record showing a code mismatch page instead of the one-time passcode page.
[Affirm] Fixed the notified approver receiving no link to join the chat when a verification was escalated to live chat.
[Affirm] Fixed location being reported as zero latitude and longitude on retries after distance thresholds were reached.
[Affirm] Fixed the back button being unavailable during motion and face capture.
[Control Center] An OAuth client assertion that fails validation returns error 1201046.
[Server] HYPR Server can now be configured to work with an outbound proxy that requires RSA key exchange on JDK 17.0.18 and later. Contact HYPR Support for the configuration.

11.3.4 - Patch 2026-09-04

Features & Enhancements

[Control Center] HYPRspeed (Desktop SSO) now works in Safari on macOS. The handoff between the browser and the workstation runs over HTTPS on a HYPR-provided hostname that resolves to the user's own machine. Requires a HYPR Cloud tenant.
[Control Center] Added a Handoff Timeout (Seconds) setting controlling how long the browser waits for the workstation to answer before falling back to the next login method. Default 60 seconds, accepted range 1 to 300.
[Control Center] Desktop SSO now continues to work on workstations that have not yet been upgraded to the client release that introduced origin reporting, so a fleet can be upgraded in stages.
[Control Center] Desktop SSO attempts the direct handoff to the local HYPR agent before falling back to the browser-launch method, restoring the order used before release 11.3.2 on workstations that do not yet hold the certificate.
[Control Center] The Desktop SSO timeout fields are now read-only for administrators whose role does not permit editing them.
[Control Center] Added the DESKTOP_SSO_TLS_BUNDLE and DESKTOP_SSO_TLS_CERT_EXPIRY_CHECK events, and error codes 1201103 and 1201104.

Known Issues

[Control Center] Immediately after an upgrade, Desktop SSO may fail to complete on a workstation for a short period before working normally.
[Control Center] Changing the workstation port in the Desktop SSO settings may prevent Desktop SSO from completing on affected workstations.

11.3.3 - Patch 2026-08-18

Bug Fixes

[Affirm] Fixed newly created escalation policies not offering the configuration available to policies created in earlier releases.
[Affirm] Fixed a blocked user receiving no clear explanation when starting a verification flow.
[Affirm] Fixed an error in the retry count when a document and biometric verification step was attempted more than once.
[Affirm] Fixed a phone or email verification step stalling when the flow was configured to accept either medium but the requester had only one of the two on file.
[Control Center] Fixed an error opening the HYPR Device Manager from an identity provider sign-in for a user matching more than one directory record.
[HYPR Passwordless for Windows] Various security enhancements. HYPR recommends that all deployments apply this patch.

11.3.2 - Patch 2026-08-01

Bug Fixes

Various platform-wide security enhancements. HYPR recommends that all deployments apply this patch.
[HYPR Mobile App for iOS] Fixed the Scan QR code button becoming unavailable after a number of workstation pairings, which left the QR scanner unable to open.

11.3.1 - Patch 2026-07-24

Features & Enhancements

[Integrations - Okta] User lookup now succeeds during Single Registration when a user's workstation and web (Okta) sign-in names use different short and full username formats.
[Control Center] Issued JWTs now automatically include the signing key's Key ID (kid) so relying parties can match a token to the correct key.
[Integrations - Microsoft Entra ID] You can now set up a Microsoft Entra integration that reuses an existing workstation relying-party application; the application is adopted into the integration.

Bug Fixes

[HYPR Mobile App for iOS] Fixed workstation unlock failing for a saved workstation after registering again.
[HYPR Mobile App for iOS] Fixed workstation and passkey deregistration failing after unlocking a saved workstation.
[HYPR Mobile App for iOS] Fixed repeated settings requests after a token refresh failure.
[HYPR Mobile App for iOS] Fixed the Save Pairing prompt appearing when unlocking a certificate-based (x509) workstation that was already paired.
[SDK] Fixed a database migration failure on a fresh install of the iOS SDK.
[Affirm] Fixed a "medium" spoofing-detection result being shown as a failure on the requester and approver scorecards.
[Affirm] Fixed identity verification returning an "Unverified" result after a successful document verification for certain document types.
[Affirm] Fixed an identity verification flow that could stall on the verification step under certain content-customization configurations.
[HYPR Mobile App for Android] Fixed Enterprise Passkey workstation unlock on Entra-joined workstations failing with "Authenticator not registered."
[HYPR Mobile App for Android] Fixed the associated passkey being disabled after deleting a web pairing from the mobile app.
[Enterprise Passkey] Fixed deregistering a HYPR Passkey not fully removing the associated workstation and web registrations from Control Center.
[HYPR Mobile App for Android] Fixed the Save Computer prompt appearing on an already-saved workstation during lock or tap-to-unlock.
[HYPR Mobile App for Android] Fixed the Save Computer prompt not appearing when unlocking a workstation as a second user registered on the same device.
[HYPR Mobile App for Android] Fixed scan-to-unlock authentication failing in multi-registration scenarios when the user is selected from the web sign-in interface.
[HYPR Passwordless for Windows on ARM] Fixed the first scan-to-unlock after pairing failing with "No certificate record found" on Entra-joined Windows on ARM.
[HYPR Passwordless for Windows] Fixed a Windows desktop SSO sign-in failure reported as an unsupported logon method on hybrid-joined workstations.
[HYPR Server] Resolved intermittent authentication failures affecting some high-volume deployments.
[Control Center] Fixed deleting an Application's JWT configuration not removing the hosted JWKS endpoint when Host JWKS Endpoint was enabled.
[HYPR Passwordless for Windows] Fixed a failure enrolling a security key certificate on a hybrid-joined workstation.
[Enterprise Passkey] Fixed deregistering one of two workstations registered to the same user on the same mobile device also removing the other workstation.
[HYPR Mobile App for iOS] Fixed the app closing unexpectedly when registering a direct passkey through Device Manager or Microsoft Entra ID.
[HYPR Mobile App for iOS] Fixed a passkey created from a workstation sign-in being removed when upgrading the app from an earlier release.
[HYPR Mobile App for iOS] Fixed HYPR Passkeys provisioned for Microsoft Entra ID being rejected when the tenant's passkey policy does not permit synced passkeys.

11.3.0 - GA 2026-06-24

Features & Enhancements

[Affirm] Identity Verification
- [Affirm] Directory image writeback to an enterprise directory or external system (Entra ID, Okta, Ping, or custom) without retaining images in HYPR.
- [Affirm] Risk Policy Builder — per-workflow risk-signal policies organized into Policy Evaluation Kits.
- [Affirm] Dual-document verification against a single live biometric capture.
- [Affirm] Customizable consent screen and pluggable custom verification steps.
- [Affirm] Expanded location and network policy controls (sanctioned-country blocking, multiple headquarters).
- [Affirm] Configurable verification data retention for biometric and document data within a workflow.
- [Affirm] Observability refresh across logs, scorecards, events, and API with standardized status semantics.
- [Affirm] National ID document type for document-type restriction.
- [Affirm] [Beta] Enhanced Identity Report with date-of-birth extraction.
[Authentication] Passkeys & Sign-In
- [Control Center] Passkey-favored login routes returning users with a platform passkey straight to passkey sign-in (integrations).
- [Control Center] HYPR auto-selects passkey as the next authenticator when a registered platform passkey exists.
- [Enterprise Passkey / HYPR Passkey] Unified Single Registration Experience for Enterprise Passkeys on iOS.
- [HYPR Mobile App for Android] HYPR Passkey as a third-party credential provider for Microsoft Entra.
- [HYPR Mobile App] In-app onboarding to enable HYPR as the device credential provider.
[HYPR Passwordless for Windows] Windows Sign-In
- [HYPR Passwordless for Windows] HYPRspeed (Desktop SSO) for Windows Hello for Business on Entra-joined and hybrid-joined workstations.
- [HYPR Passwordless for Windows] Connection-handling resilience for transient network-path failures.
- [HYPR Passwordless for Windows] Bundled ARM YubiKey minidriver in the installer.
[HYPR Passwordless for Mac] macOS Client
- [HYPR Passwordless for Mac] Enforce HYPR login after macOS sign-in, manual fallback code entry, and YubiKey PIN policy.
[Control Center] Platform
- [Control Center] FIDO2 Metadata Service UI in Standard view; AAGUID returned in FIDO2 responses; configurable FIDO2 OOB field.
- [Event Hooks] Backward compatibility with earlier Control Center versions.
- [Control Center] Identity provider configuration accepts Microsoft identity platform v2.0 endpoints; existing v1 configurations are unaffected.

Bug Fixes

[Affirm] Restored requester first and last name to the activity log.
[Affirm] Fixed multiple-approver sourcing when two concurrent requesters share a session in the Login ID step.
[Affirm] Fixed users whose email differs from their login identifier being treated as having no registered devices.
[Affirm] Fixed disabling escalation not clearing the escalation approver list.
[Affirm] Fixed SMS session connections not being released after a service interruption.
[Affirm] Fixed the Helpdesk tab showing no records when changing the time-range filter on a single-page result set.
[Affirm] Fixed the activity log final page returning no records when the count is an exact multiple of the page size.
[Affirm] Fixed users with no IdP display name appearing as "null" in the Affirm UI.
[Affirm] Fixed Login ID field styling in workflows created via API.
[Affirm] Fixed document spoofing detection evaluating an incorrect result value.
[Affirm] Fixed the document-and-biometric step not being disable-able after it was enabled.
[Affirm] Fixed the document-and-biometric step not accounting for liveness-disabled configurations.
[Affirm] Fixed flows with a Liveness step breaking sign-in after promotion to a later release.
[Affirm] Fixed broken links in the Advanced Customizations section of Control Center.
[Affirm] Fixed internal custom-step configuration details being included in the verification-flow API response.
[Affirm] Fixed a server event emitted with method=UNKNOWN when an approver invite could not be sent.
[Affirm] Fixed CSS-styling regressions on scorecards.
[Affirm] Fixed black-screen selfie capture during an iPad-initiated verification.
[Affirm] Fixed content-customization requests returning 400 instead of a validation message.
[Affirm] Fixed Affirm not being selectable as the authenticator with OpenID Connect and Microsoft Entra ID integrations.
[Affirm] Fixed Code customizations not being editable after creation due to a UI-rendering failure.
[Affirm] Fixed the Affirm authenticator appearing as a sign-in option when not enabled for the tenant.
[Affirm] Fixed the Affirm authenticator not working with Cloudflare OIDC integrations.
[Affirm] Fixed SMTP send failures not surfacing a user-facing error in the Affirm UI.
[Affirm] Fixed display copy on the Helpdesk portal escalation flow.
[Adapt] Fixed a policy-assignment screen cache issue affecting Rp app and policy updates.
[Adapt] Fixed error-logging noise when Adapt was enabled with no policy assigned to the pre-auth integrations group.
[Control Center] Fixed integrating Microsoft Entra ID not toggling the workstation-enabled flag.
[Control Center] Fixed a connection-recovery issue after database failover.
[Control Center] Fixed an incorrect screen shown to users in a permanent lockout state.
[Control Center] Fixed failed-authentication events for blocked users being misreflected in activity logs.
[Control Center] Fixed Okta integration authentication timeouts producing misleading failed-auth entries.
[HYPR Mobile App for iOS] Fixed a duplicate saved workstation tile created when re-scanning a QR code for a workstation already saved.
[HYPR Mobile App for iOS] Fixed scan-to-unlock being rejected for a saved workstation.
[HYPR Mobile App for iOS] Fixed the Save This Device prompt not appearing when scanning a QR code at a workstation other than the one originally used.
[HYPR Mobile App for iOS] Corrected the saved-workstation tile indicator color and the layout of the Save This Device toggle.
[HYPR Mobile App for iOS] Fixed a crash when registering a workstation and web account in a single registration.
[HYPR Mobile App for iOS] Fixed a crash when scanning a QR code with the native camera.
[HYPR Mobile App for iOS] Fixed a missing error message when scanning a QR code generated with an invalid token.
[HYPR Mobile App for iOS] Fixed the app showing an unlock message instead of a registration message when it was launched from a mobile browser to register a device.
[HYPR Mobile App for Android] Fixed roaming unlock after a certificate renewal in a single registration.
[Affirm] Fixed an error state when the document issuer returned an inconclusive overall result.
[Enterprise Passkey] Fixed workstation sign-in using a passkey other than the one registered for the account in use.
[Control Center] Security hardening: strengthened authorization validation on application-scoped operations.
[Control Center / FIDO2] Security hardening: strengthened input validation on FIDO2 metadata service updates.
[Server] Fixed excessive error logging when processing certain workstation audit payloads.
[Server] Fixed a workstation request encoding issue.
[Enterprise Passkey] Fixed hybrid-account mobile pairing failing to save.
[Enterprise Passkey] Fixed an iOS app crash when deleting a web registration during pairing.
[Enterprise Passkey] Fixed TalkBack not announcing timeout seconds on the save-computer prompt (Android).
[Enterprise Passkey] Fixed an Android crash when pairing a web account on a device with many existing pairings.
[Enterprise Passkey] Fixed the save-computer prompt appearing after QR-scan unlock during pairing (Android).
[Enterprise Passkey] Fixed a blank delete-confirmation screen when deleting a web pairing.
[Enterprise Passkey] Fixed deleting a workstation pairing breaking a subsequent unlock in multi-registration scenarios.
[Enterprise Passkey] Fixed a registration crash for users with many existing pairings.
[Enterprise Passkey] Security hardening: strengthened passkey credential-handling across the mobile app and server.
[HYPR Passwordless for Windows] Fixed YubiKey Bio fingerprint registration UX not displaying at the end of registration.
[HYPR Passwordless for Windows] Fixed an incorrect alert when installing the x64 MSI on a Windows ARM workstation.
[HYPR Passwordless for Windows] Fixed a HYPR Passkey not registering on a new Crescendo 4000 card in the workstation client.
[HYPR Passwordless for Windows] Fixed workstation audit events getting stuck in the upload queue when Control Center rejected the payload.
[HYPR Passwordless for Windows] Security hardening: additional code-signing and runtime hardening for Windows components.
[HYPR Passwordless for Windows] Security hardening: resolved CVE-2026-4522, a credential-handling vulnerability.
[HYPR Passwordless for Mac] Fixed the PIN-blocked screen showing for security keys when both PUK and PIN were blocked.
[HYPR Passwordless for Mac] Fixed client log downloads failing in certain environments.
[HYPR Passwordless for Mac] Security hardening: resolved a macOS file-handling vulnerability.
[HYPR Passwordless for Mac] Security hardening: strengthened inter-process communication channels.
[HYPR Passwordless for Mac] Security hardening: strengthened enforcement of HYPR as a required authentication factor.
[HYPR Mobile App for Android] Fixed a sign-in failure for HYPR Passkey on Microsoft OneNote on workstation.
[HYPR Mobile App for Android] Fixed a sign-in failure with HYPR Passkey for Google accounts.
[HYPR Mobile App for Android] Fixed duplicate passkeys created when pairing the same user a second time.
[HYPR Mobile App for Android] Fixed no error message when scanning a roaming-unlock QR on the lock screen with no pairing.
[HYPR Mobile App for Android] Fixed workstation lock from the mobile app failing with multiple registered workstations.
[HYPR Mobile App for Android] Fixed mobile-app UI elements overlapping the Android system home buttons.
[HYPR Mobile App for Android] Fixed automatic app launch from a mobile browser misbehaving in managed work-profile or multi-app contexts.
[HYPR Mobile App for iOS] Fixed the account-list screen showing the user's email/username instead of the relying-party app name during Single Registration.
[HYPR Mobile App for iOS] Fixed the QR Fallback Code and App Name fields not showing already-registered tenant URLs.
[HYPR Mobile App for iOS] Fixed an offline-mode certificate transfer failure.
[HYPR Mobile App for iOS] Fixed passkey deletion not showing a success checkmark.
[HYPR Mobile App for iOS] Fixed unlock still succeeding after Single Registration deregistration when "Don't Create Pairing" was selected.
[HYPR Mobile App for iOS] Fixed an app crash during device de-registration after passkey deletion.
[HYPR Mobile App for iOS] Fixed a back-button display issue on the paired-account detail screen on iOS 26.2.
[HYPR Mobile App for iOS] Fixed direct passkey sign-in to Microsoft applications and the Microsoft portal failing.
[HYPR Mobile App for iOS] Fixed certificate re-enrollment during Single Registration roaming-unlock breaking subsequent unlocks.
[HYPR Mobile App for iOS] Security hardening: HYPR Passkey private keys are now stored exclusively in the iOS Keychain.
[SDK] Fixed a QR-code creation encoding issue in SDK integrations that use SSL pinning.
[SDK] Fixed the web registration display name being set to the workstation account name instead of the workstation name.
[Integrations - Okta] Fixed 404 errors during user lookups for identifiers not in the upstream Okta directory.
[Integrations - Okta] Fixed a transient "IDP API Token is not valid from Okta API" message during page rendering.
[Integrations] Fixed an "object already exists" error when adding an integration as a HYPR user.
[Integrations] Fixed an integration being deleted on an existing-name conflict; clearer error messaging on retry.
[Integrations - Okta] Fixed the Okta API token under the Integrations tab failing to update.
[Integrations - Okta] Fixed removing a user's last registered device not updating their status in Okta.
[Integrations - Microsoft Entra ID] Fixed Entra autosync not synchronizing all users from the directory.

Known Issues

[HYPR Mobile App for iOS] A saved workstation tile may continue to offer Lock after the workstation has already been locked.
[Affirm] When required identity attributes are missing from the directory and Affirm is the authenticator, sign-in may show a generic invalid-credentials error instead of naming the missing attribute.
[Affirm] Custom verification steps may not appear in the Activity Log or Helpdesk activity log for a verification.
[Affirm] A verification flow marked inactive may still trigger when referenced by an integration's Login settings.
[Affirm] A verification flow not assigned to an integration may still appear as a selectable Affirm authenticator option there.
[Affirm] The Helpdesk verification-flow count may not include flows created during the current session.
[Affirm] Deleting the last OIDC configuration on a verification flow may leave it unsaveable.
[Affirm] In Advanced view, the Affirm authenticator may not be controllable through an integration's Login Settings.
[Affirm] A user blocked from initiating a verification flow may receive a generic error instead of a clear blocked-account message.
[Adapt] After a cold start of the risk engine (for example, after an upgrade), a blocked policy might not be applied.
[Control Center] The server may still send push notifications with incorrect proxy credentials.
[Control Center] The Magic Link session auth limit may be unavailable for Integrations applications, and the create-Magic-Link option may not appear in Advanced view.
[Control Center / Keycloak] Microsoft Entra Desktop SSO may not complete when the initiating client omits the login_hint parameter.
[Control Center / Keycloak] With a Conditional policy enabled and no registered HYPR device, username-and-password sign-in may fail.
[Enterprise Passkey] [Unified Single Registration] For registrations created before 11.1.0, the save-computer prompt may not appear during pairing; re-registration is required (beta limitation).
[Enterprise Passkey] [Unified Single Registration] Locking the workstation immediately after saving the computer can fail when there is no valid Windows session entry; a subsequent attempt usually succeeds.
[Enterprise Passkey] [Unified Single Registration] In multi-user, multi-workstation save scenarios, the first tap-to-unlock of a newly-saved workstation by the original identity may fail; clearing HYPR Mobile App data resolves it.
[Enterprise Passkey] [Unified Single Registration] Deleting a web pairing from the mobile app may stop the associated passkey from working; re-registration may be required (Android).
[Enterprise Passkey] Deregistering a HYPR Passkey from the mobile app may not fully remove the workstation or web registration from Control Center; administrators may need to clean these up manually.
[Enterprise Passkey] When two workstations are paired to the same user from one mobile device, deregistering one may also remove the other.
[HYPR Passwordless for Windows] The HYPR Service may not always restart after resuming from Modern Standby or hibernation, with repeated restart attempts and network-recovery failures.
[HYPR Passwordless for Windows] [Enterprise Passkey] An MFA prompt may appear for users not in the Conditional Access policy list.
[HYPR Passwordless for Windows] [Enterprise Passkey] Deleting a FIDO2 HID device from the workstation client may surface an unexpected error.
[HYPR Passwordless for Windows] With Interactive Logon enabled and the last logged-on user a local account, scanning the QR code may show a black screen.
[HYPR Passwordless for Windows] A stale PAC URL or proxy reference left by a removed proxy/SASE client can cause connection failures during pairing or unlock (error 1590001); remove the stale reference to resolve.
[HYPR Passwordless for Windows] Some Windows login-screen text may appear incorrectly under certain circumstances.
[HYPR Passwordless for Windows] If the YubiKey minidriver is updated by the installer, a reboot is required.
[HYPR Passwordless for Windows on ARM] [Preview] On Entra-joined Windows on ARM, the first scan-to-unlock after pairing may fail ("No certificate record found"); subsequent attempts succeed.
[HYPR Passwordless for Windows on ARM] [Preview] Registration may not complete on domain- or Entra-joined Windows on ARM virtual machines.
[HYPR Passwordless for Windows on ARM] [Preview] The certificate re-enrollment prompt may not appear when a renewal would normally trigger.
[HYPR Passwordless for Windows on ARM] [Preview] Auto-upgrade may attempt the x64 build and fail; install the ARM build manually.
[HYPR Passwordless for Windows on ARM] [Preview] The client may close unexpectedly under certain conditions.
[HYPR Passwordless for Windows on ARM] [Preview] The HYPR smart card reader component may fail to install on Windows on ARM virtual machines.
[HYPR Mobile App for Android] [Unified Single Registration] The Save Computer prompt may appear on an already-saved workstation tile during lock or tap-to-unlock; clearing app data or reinstalling resolves it.
[HYPR Mobile App for Android] Directly registering a HYPR Passkey for Microsoft Entra ID may report an Entra-side failure while the passkey is created locally and cannot be used for Entra sign-in; register again through another channel.
[HYPR Mobile App for Android] In multi-registration scenarios, scan-to-unlock authentication can fail when the user is selected from the web sign-in interface.
[HYPR Mobile App for Android] An existing web-account pairing can be deleted if a push notification arrives mid-pairing.
[HYPR Mobile App for Android] Enterprise Passkey workstation unlock on Entra-joined workstations may fail with "Authenticator not registered."
[HYPR Mobile App for Android] Web-initiated scan-to-unlock may fail when another workstation is paired to a different domain or user on the same device.
[HYPR Mobile App for Android] When a workstation is already saved and a second user registers on the same device, the workstation QR icon may not appear; a single QR scan option is shown instead.
[HYPR Mobile App for Android] On OnePlus devices running Android 14, HYPR may not function as a third-party passkey credential provider, due to the device's non-standard operating-system implementation.
[HYPR Mobile App for iOS] Home-screen text below the logo may still read "True Passwordless Security" instead of "Identity Assurance."
[HYPR Mobile App for iOS] Registration may continue without an alert when a future-dated version-enforcement policy is configured.
[HYPR Mobile App for iOS] On certificate-based (x509) workstations, the Save Pairing prompt may appear on unlock even when already paired.
[HYPR Mobile App for iOS] [Unified Single Registration] In multi-user scenarios, the user picker may show the web relying-party app name instead of the user's UPN.
[HYPR Mobile App for iOS] Deregistering a saved workstation pairing may remove the full HYPR registration.
[HYPR Mobile App for iOS] Tap-to-lock on a unified-registration workstation tile may fail under certain pairing configurations.
[HYPR Mobile App for iOS] Registering a workstation via the client first and then via web unified registration may create duplicate passkeys and tiles.
[HYPR Mobile App for iOS] The Set as default workstation control is unavailable for unified-registration workstation tiles.
[HYPR Mobile App for iOS] Authentication into a Microsoft application using a direct Entra passkey may fail; web-based authentication with the same passkey is unaffected.
[HYPR Mobile App for iOS] The app may close unexpectedly when registering a direct passkey through Device Manager or Microsoft Entra ID.
[HYPR Mobile App for iOS] A passkey created from a workstation sign-in may be removed after upgrading the app from an earlier release.
[HYPR Mobile App for iOS] HYPR Passkeys provisioned for Microsoft Entra ID may be rejected when the tenant's passkey policy does not permit synced passkeys.
[Integrations - Okta] The Enroll button may appear for Control Center administrators who are not in the Okta directory.
[Integrations - Okta] New integrations may fail to be added due to "Default Policy" errors.
[Integrations - OneLogin] Already-enrolled users may still appear in the integration's User Directory in Control Center.

11.1.2 - Patch 2026-05-15

Bug Fixes

[HYPR Mobile App for Android] Fixed the PIN entry screen overlapping the Android home and navigation buttons on certain devices.
[Control Center] Security hardening for FIDO-only profile deregistration.
[Enterprise Passkey / HYPR Passwordless for Windows] Fixed Offline PIN authentication failing when a virtual smart card or security key was inserted before PIN entry.
[HYPR Passwordless for Windows] Fixed authentication failures from inconsistent letter casing in domain or machine usernames, affecting roaming login and workstation unlock on domain-joined workstations.
[HYPR Passwordless for Windows] Security hardening: applied Authenticode signatures to additional Windows service components.
[HYPR Passwordless for Windows] Security hardening applied to HYPR Passwordless for Windows.

Known Issues

[Adapt] After a cold start of the risk engine (for example, after an upgrade), a blocked policy might not be applied.
[Authenticate] The HYPR Service may not always restart after resuming from Modern Standby or hibernation, with repeated restart attempts and network-recovery failures.
[Control Center] The server may still send push notifications with incorrect proxy credentials.
[Enterprise Passkey / HYPR Passkey] [Unified Single Registration] For registrations created before 11.1.0, the save-computer prompt may not appear during pairing; re-registration is required (beta limitation).
[Enterprise Passkey / HYPR Passkey] [Unified Single Registration] Locking the workstation immediately after saving the computer can fail when there is no valid Windows session entry; a subsequent attempt usually succeeds.
[Enterprise Passkey / HYPR Passkey] Deregistering a HYPR Passkey from the mobile app may not fully remove the workstation or web registration from Control Center; administrators may need to clean these up manually.
[HYPR Mobile App for iOS] Home-screen text below the logo may still read "True Passwordless Security" instead of "Identity Assurance."
[HYPR Mobile App for iOS] Registration may continue without an alert when a future-dated version-enforcement policy is configured.
[HYPR Passwordless for Windows] Some Windows login-screen text may appear incorrectly under certain circumstances.
[HYPR Passwordless for Windows] If the YubiKey minidriver is updated by the installer, a reboot is required.
[Integrations - Okta] The Enroll button may appear for Control Center administrators who are not in the Okta directory.
[Integrations - Okta] New integrations may fail to be added due to "Default Policy" errors.
[Integrations - OneLogin] Already-enrolled users may still appear in the integration's User Directory in Control Center.

11.1.1 - Patch 2026-04-22

Bug Fixes

[Affirm] Restored requester first and last name to the activity log (inadvertently removed in 11.1.0).
[Affirm] Fixed multiple-approver sourcing when two concurrent requesters share a session in the Login ID step.
[Affirm] Fixed document spoofing detection evaluating an incorrect result value.
[Affirm] Fixed broken links in the Advanced Customizations section of Control Center.
[Affirm] Fixed Login ID field styling in workflows created via API.
[Enterprise Passkey] Fixed workstation unlock failures when using provisioned HID or IDEMIA smart cards.
[Enterprise Passkey] Fixed the fingerprint confirmation screen not displaying after successful YubiKey Bio registration.
[Enterprise Passkey / Keycloak] Fixed Desktop SSO returning an "Unexpected error" for users with Entra federation configured.
[Integrations - Okta] Fixed removing a user's last registered device not updating their status in Okta.

Known Issues

[Adapt] After a cold start of the risk engine (for example, after an upgrade), a blocked policy might not be applied.
[Authenticate] The HYPR Service may not always restart after resuming from Modern Standby or hibernation, with repeated restart attempts and network-recovery failures.
[Control Center] The server may still send push notifications with incorrect proxy credentials.
[Enterprise Passkey / HYPR Passkey] [Unified Single Registration] For registrations created before 11.1.0, the save-computer prompt may not appear during pairing; re-registration is required (beta limitation).
[Enterprise Passkey / HYPR Passkey] [Unified Single Registration] Locking the workstation immediately after saving the computer can fail when there is no valid Windows session entry; a subsequent attempt usually succeeds.
[Enterprise Passkey / HYPR Passkey] Deregistering a HYPR Passkey from the mobile app may not fully remove the workstation or web registration from Control Center; administrators may need to clean these up manually.
[HYPR Mobile App for iOS] Home-screen text below the logo may still read "True Passwordless Security" instead of "Identity Assurance."
[HYPR Mobile App for iOS] Registration may continue without an alert when a future-dated version-enforcement policy is configured.
[HYPR Passwordless for Windows] Some Windows login-screen text may appear incorrectly under certain circumstances.
[HYPR Passwordless for Windows] If the YubiKey minidriver is updated by the installer, a reboot is required.
[Integrations - Okta] The Enroll button may appear for Control Center administrators who are not in the Okta directory.
[Integrations - Okta] New integrations may fail to be added due to "Default Policy" errors.
[Integrations - OneLogin] Already-enrolled users may still appear in the integration's User Directory in Control Center.

11.1.0 - GA 2026-03-27

Features & Enhancements

[Affirm] Verification, Messaging & Help Desk Improvements
- [Affirm] Liveness-only verification option without document upload.
- [Affirm] Configurable allowed ID‑issuing countries for document verification.
- [Affirm] Optional regional SMS routing for Canada.
- [Affirm Help Desk] Longer completed-request visibility on the Help Desk tab.
- [Affirm Help Desk] Dedicated Help Desk roles and access controls.
- [Affirm Help Desk] Improved agent session-timeout messaging, initialize defaults, and refresh behavior.
[Affirm] Studio & Content Customization Improvements
- [Affirm Studio] Inline previews for key screens directly in the Studio editor.
- [Affirm Studio] Improved caching and storage for content customizations.
[Affirm / Integrations] Integration Login Routing to Affirm
- [Affirm / Integrations] New Affirm authenticator option in Integration Login Settings.
[Android] Offline PIN support for HYPR Passkey
- [Android] Offline PIN support for passkey authentications when temporarily offline.
[HYPR Mobile App for Android] Account Selection Prompt for WFA QR Login
- [HYPR Mobile App for Android] When multiple registrations are present on the device, scanning a WFA QR code now presents an account selection prompt.
[Enterprise Passkey] Unified Single Registration Experience for Enterprise Passkeys (Beta) for Android
- [Enterprise Passkey / HYPR Passkey] [Beta] Unified Single Registration Experience for Enterprise Passkeys for Android.
[Platform] Email Template & Support Tooling Enhancements
- [Platform] Custom image uploads in email templates.
- [Platform] [Beta] Email notification configuration workspace.
- [Platform] [Beta] Centralized client log upload and retrieval for support operations.
[Control Center] Operational UX & Self-Hosted Configuration
- [Control Center] Single Registration pilot group support for staged rollouts.
- [Control Center] Go to Help Desk button from configuration views.
- [Control Center] Feature configuration as code for self-hosted deployments.
- [Control Center] New device notification emails honor the tenant support email.
[HYPR Passwordless for Windows] Windows Login, Pairing & Citrix Reliability
- [HYPR Passwordless for Windows] [Beta] ARM-based Windows device support on demand.
- [HYPR Passwordless for Windows] Configure YubiKey PIN policy during pairing.
- [HYPR Passwordless for Windows] Bundled YubiKey smart‑card minidriver for Citrix.
- [HYPR Passwordless for Windows] Improved roaming, QR reconnection, and YubiKey Bio enrollment in Citrix.
- [HYPR Passwordless for Windows] Various general UI improvements.
[Integrations] Microsoft External MFA generally available
- [Integrations] HYPR with Microsoft External Multi-Factor Authentication (External MFA) capability generally available.

Bug Fixes

[Adapt] Fixed unrelated event ingestion caused by signal handler conditions.
[Affirm] Improved error handling and stricter validation for content customization in Control Center.
[Affirm] Fixed advanced end-user and Help Desk issues for customized verification workflows.
[Control Center] Fixed an issue that could prevent log content from being retrieved in Control Center.
[HYPR Mobile App for Android] Fixed passkey display and improved domain allow‑list enforcement and error messaging.
[HYPR Mobile App for Android] Resolved multiple passkey UX issues so failed registrations no longer break app and QR flows.
[HYPR Passwordless for Windows] Improved certificate enrollment error handling for clearer diagnostics.
[HYPR Passwordless for Windows] Resolved uninstall/upgrade prompt prompting users to close Microsoft Edge.
[Server] Fixed minor log retrieval behavior so administrator log links are cleaner and more reliable.

Known Issues

[Adapt] After a cold start of the risk engine (for example, after an upgrade), a blocked policy might not be applied.
[Authenticate] The HYPR Service may not always restart after resuming from Modern Standby or hibernation, with repeated restart attempts and network-recovery failures.
[Control Center] The server may still send push notifications with incorrect proxy credentials.
[Enterprise Passkey / HYPR Passkey] [Unified Single Registration] For registrations created before 11.1.0, the save-computer prompt may not appear during pairing; re-registration is required (beta limitation).
[Enterprise Passkey / HYPR Passkey] [Unified Single Registration] Locking the workstation immediately after saving the computer can fail when there is no valid Windows session entry; a subsequent attempt usually succeeds.
[Enterprise Passkey / HYPR Passkey] Deregistering a HYPR Passkey from the mobile app may not fully remove the workstation or web registration from Control Center; administrators may need to clean these up manually.
[HYPR Mobile App for iOS] Home-screen text below the logo may still read "True Passwordless Security" instead of "Identity Assurance."
[HYPR Mobile App for iOS] Registration may continue without an alert when a future-dated version-enforcement policy is configured.
[HYPR Passwordless for Windows] Some Windows login-screen text may appear incorrectly under certain circumstances.
[HYPR Passwordless for Windows] If the YubiKey minidriver is updated by the installer, a reboot is required.
[Integrations - Okta] The Enroll button may appear for Control Center administrators who are not in the Okta directory.
[Integrations - Okta] New integrations may fail to be added due to "Default Policy" errors.
[Integrations - OneLogin] Already-enrolled users may still appear in the integration's User Directory in Control Center.

10.7.1 - GA 2026-01-07

Features & Enhancements

[Affirm] Studio & Branding
- [Affirm] Affirm Studio for configurable end‑user screen content and visual themes.
- [Affirm] SMS Notification Branding using Company Identity name and support email.
[Affirm] Identity Verification & Policy Controls
- [Affirm] Network and location‑based policy controls for identity verification workflows.
- [Affirm] [Preview] Identity Verification via Microsoft Entra Verified Credentials.
- [Affirm] Enhanced user directory customizations and OIDC integration.
- [Affirm] Improved single‑user workflow API, retry limits, and failure handling.
- [Affirm] Refined labels, event logging, and Help Desk user experience.
[Enterprise Passkey] Desktop & Mobile
- [Enterprise Passkey] [Preview] FIDO2 Security Key Provisioning for Entra ID.
- [Enterprise Passkey] [Preview] Windows HYPR Passkey integration improvements.
- [Enterprise Passkey] [Preview] Mobile passkey registration gating and controls.
[Authenticate] Windows & macOS
- [Authenticate for Windows] Improved architecture, logging, and dependency updates.
- [Authenticate for Windows] More flexible deployment via JSON and CLI configuration updates.
- [Authenticate for Windows] Enhanced smart‑card checks and notification customization.
- [Authenticate for Windows] Stricter password filtering and additional provider filtering options.
- [Authenticate for Windows] Always‑passwordless option and better YubiKey Bio enrollment in Citrix.
- [Authenticate for Mac] Improved PUK handling for security keys to align with Windows behavior.
[Control Center] Platform & Certificates
- [Control Center] Single Registration certificate renewal for Web Registration.
- [Control Center] Enhanced security key activity tracking in user management.
- [Control Center] Improved QR fallback user experience.
- [Control Center] Metrics and monitoring for Adapt event handlers.
[Adapt] Risk & Policy
- [Adapt] Enhanced policy evaluation controls and configuration validation.
- [Adapt] Improved login‑limit handling and messaging.
[Integrations & Platform]
- [Integrations - Keycloak] Enhanced logging controls and log message handling.
- [Integrations - Keycloak] Improved cookie handling performance.
- [Mobile & Workstation / Platform] Expanded centralized log collection and time‑zone aware logging.
- [Mobile & Workstation / Platform] Improved QR fallback UX and overall reliability.

Bug Fixes

[Adapt] Fixed signal handler execution, login‑limit display, and feature‑flag behavior.
[Affirm] Fixed workflow routing, chat escalation, outcome handling, and activity logging.
[Affirm] Fixed Onfido and liveness result selection and related activity‑log fields.
[Authenticate for Windows] Fixed Citrix VDI crashes, recovery PIN display, and retry options.
[Authenticate for Windows] Fixed workstation deregistration, unlock errors, and log‑file paths.
[Authenticate for Mac] Fixed security key recovery PIN visibility and custom branding uninstall.
[Control Center] Fixed user listing performance and certificate re‑enrollment UI issues.
[Control Center] Fixed QR fallback edge cases and missing deregistration audit events.
[Enterprise Passkey] Fixed workstation pairing deregistration and unlock flows leaving devices locked.
[Enterprise Passkey] Fixed Entra federation integration issues and related audit gaps.
[HYPR Mobile App for Android] Fixed QR unlock user selection, deep‑link handling, and pairing removal.
[HYPR Mobile App for iOS] Fixed crashes, offline PIN regeneration, rate limiting, and HYPR Passkey flows.
[Integrations - Keycloak] Fixed QR rendering, fallback UI, and Jamf login QR display issues.
[Integrations - Entra / Okta / Ping / RADIUS] Fixed setup errors and tightened RADIUS validation.
[Platform] Improved DELETE performance, crypto validation, and configuration error handling.

10.5.0 - GA 2025-09-24

Features & Enhancements

[Adapt] Security & Policy
- [Adapt] Security hardening for event hooks
- [Adapt] Clearer validation for Adapt Login Limits
- [Adapt] Reduced DB load for landing stats on large tenants
- [Adapt] Standalone IP Geolocation service (POST lookup; validated input)
- [Adapt] Action events re‑enabled when Adapt is on
[Affirm] Identity Verification
- [Affirm] [Beta] Advanced Deepfake/Motion Detection
- [Affirm] UX: clearer /unblock responses
- [Affirm] UX: collapsible step settings
- [Affirm] UX: terminology consistency and visual alignment
- [Affirm] UX: improved step‑failure handling
- [Affirm] UX: editor stability
- [Affirm] Logging/Analytics: accurate factor labels and denial reasons
- [Affirm] Logging/Analytics: OIDC flow fixes
- [Affirm] Logging/Analytics: custom‑code hardening
[Affirm] Help Desk
- [Affirm] [Beta] End‑to‑End Help Desk (role‑based agents, auditing)
[Authenticate] Windows
- [Authenticate for Windows] [Beta] HID Crescendo 4000 smart cards/keys incl. contactless
- [Authenticate for Windows] Enterprise Passkey excluded from external auth events
- [Authenticate for Windows] Windows authentication sub‑status codes added to audit
- [Authenticate for Windows] Device/credential provider UX refinements
[Authenticate] macOS
- [Authenticate for Mac] Recovery PINs for security keys with policy controls and auditing
[Control Center] Platform
- [Control Center] OAuth API Tokens across CC APIs (Java SDK support)
- [Control Center] FIDO2 MDS allow/deny controls
- [Control Center] Improved validation messaging
- [Control Center] Improved security for sensitive data
- [Control Center] Force Re‑Enroll action in User Management
- [Control Center] Associated user lookup API
- [Control Center] Safer, more performant audit/statistics queries
[Enterprise Passkey] Desktop & Web Authentication
- [Enterprise Passkey] Offline desktop login (encrypted Offline PINs; CC policy + auditing)
- [Enterprise Passkey] HYPR Passkey (formerly known as the Third‑Party Passkey Provider): HYPR One as native passkey provider (iOS/Android); Windows OS/browser sign‑in with synced passkeys; session‑passkey SSO; QR fallback
- [Enterprise Passkey] Mobile registration from web or deep link; single passkey for desktop and web (Entra joined/hybrid unlock + mobile HYPR Passkey web auth)
[HYPR Mobile App for Android] Mobile UX & Reliability
- [HYPR Mobile App for Android] Low‑remaining Offline PINs warning
- [HYPR Mobile App for Android] Deep link approval prompt
- [HYPR Mobile App for Android] Default workstation handling improvements
- [HYPR Mobile App for Android] Faster UI updates for success/error and PIN refresh
[HYPR Mobile App for iOS] Mobile UX & Reliability
- [HYPR Mobile App for iOS] Editorial copy and UI text consistency
[Integrations]
- [Integrations - Entra] Federation/admin UX: Client Credential Grant (back‑compat)
- [Integrations - Entra] Updated MFA claims handling (federatedIdpMfaBehavior)
- [Integrations - Entra] Clearer client secret/cert setup
- [Integrations - Entra] Improved naming and integration type labels
- [Integrations - Keycloak] Custom theming/branding
- [Integrations - Keycloak] Dynamic QR link
[Server/Authenticate] Runtime & Transport
- [Server/Authenticate] WebSocket long‑polling disabled by default (opt‑in)

Bug Fixes

[Adapt] Security & Policy
- [Adapt] Secret fields masked in logs/results
- [Adapt] Monitor Auth block evaluation fixed
- [Adapt] Signal Handler “Learn more” links corrected
- [Adapt] Stop ingest after tenant deletion
- [Adapt] Action events enforced when Adapt is enabled
[Affirm] User Experience & Workflow
- [Affirm] OIDC config save on blank
- [Affirm] Copy alignment on Take a Selfie
- [Affirm] Web liveness timeout UX improved
- [Affirm] DM outcome validation for missing RP App/URL cases
- [Affirm] Deleted‑flow name shown in messages
- [Affirm] No Retry beyond configured limit
- [Affirm] IDV settings visible in verification flow settings
- [Affirm] Factor labels/denial reasons accurate in Activity Log/Help Desk
- [Affirm] Phone‑pass status displayed when phone verification runs without OTP
- [Affirm] Requester OIDC prompts without pre‑set context
- [Affirm] Callback not found resolved
- [Affirm] Injectable outcomes fail overall flow when configured
- [Affirm] Custom‑code hardening in configuration workflows
- [Affirm] Redirect URL validation shows correct message
[Affirm] Help Desk
- [Affirm] Help Desk refresh while viewing Verification Flows no longer causes invalid session
[Authenticate] macOS
- [Authenticate for Mac] App name/icon update across Spotlight/Applications/Launchpad/Dock (incl. CustomSkin)
[Authenticate] Windows
- [Authenticate for Windows] YubiKey Bio full DB enrollment skip
- [Authenticate for Windows] Removed Enterprise Passkey cert‑only log during Enterprise Passkey auth
- [Authenticate for Windows] Fingerprint enrollment retry succeeds
- [Authenticate for Windows] Security key touch policy enforced on enrollment
- [Authenticate for Windows] Passwordless User tile shows domain on domain‑joined machines
[Control Center] Platform & UI
- [Control Center] Audit export 406/“undefined” → 200 with valid CSV
- [Control Center] Access level focus in Advanced UI fixed
- [Control Center] CC Users Last Active time zone consistent across views
- [Control Center] Deleting paired device removes across CC, Windows, Mobile
- [Control Center] Enterprise Passkey workstation‑pairing deregistration syncs with mobile and CC
[Enrollment Service]
- [Enrollment Service] No API token deletion on unexpected 401; resilient lifecycle
[HYPR One] Android
[HYPR Mobile App for Android] Background push approvals succeed
[HYPR Mobile App for Android] Token lifecycle maintains locks/deregistration responses
[HYPR Mobile App for Android] QR unlock hybrid roaming fixed
[HYPR Mobile App for Android] TalkBack double‑tap activates lock/unlock on Entra‑only bubbles
[HYPR One] iOS
[HYPR Mobile App for iOS] Offline/Recovery PIN pools refresh after online unlock
[HYPR Mobile App for iOS] Third‑party passkey provider registration/deletion reliability
[Integrations - Keycloak]
- [Integrations - Keycloak] Removed legacy brute force detection
- [Integrations - Keycloak] Log only when brute‑force enforcement occurs
[Server] Platform
- [Server] Unicode/full‑width username handling improved
- [Server] WARNs suppressed when FIDO2 not configured
[Windows/Enrollment Service]
- [Windows/Enrollment Service] Per‑application TPM artifact directories prevent cross‑app interference

10.3.0 - GA 2025-06-25

Enhancements

[Affirm] User Experience & Workflow
- [Affirm] Added processing animations to long waiting steps in the web UI for improved user feedback.
- [Affirm] Removed the "Continue" button from the "Almost Done!" screen for a more streamlined experience.
- [Affirm] Enhanced the Affirm link in Keycloak login and enabled customization of link text and URL in the QR code UI.
- [Affirm] Vault setup for SMS attribute values, allowing for environment-specific control of SMS content.
- [Affirm] Introduced the End-User Screen Management System, allowing admins to manage and preview content and branding on end-user screens within the Affirm workflow.
- [Affirm] Added pagination to the Affirm flow page for easier navigation.
- [Affirm] Enhanced support for single-user workflows, including programmatic initialization and read-only username options.
- [Affirm] Added application selection to verification step setup for more flexible flow configuration.
- [Affirm] Friction level support in the API for Affirm, allowing for more granular workflow customization.
- [Affirm] Improved Affirm Dashboard with more accurate and complete report metrics.
- [Affirm] Support for DYNAMIC approver type in the UI to match API capabilities.
- [Affirm] Improved location event tracking with separate events for geocode and IP distance.
- [Affirm] Improved branding and logo aspect ratio handling in custom branding.
- [Affirm] Improved error messaging and UI feedback throughout the Affirm and Keycloak integrations.
[Affirm] Compliance, Security, and Verification
- [Affirm] Injectable Outcomes: Customers can now define dynamic outcomes for each verification step in Affirm workflows.
- [Affirm] Integrated KYC, AML, and OFAC checks, as well as expired document checks, into the Affirm workflow for enhanced compliance.
- [Affirm] Photo and Liveness Detection: Improved user guidance, real-time feedback, and accuracy for biometric verification.
[Affirm] Help Desk
- [Affirm] Help Desk Application: Added support for 6-digit PIN verification, workflow initialization for contacts, sending workflow IDs via email or SMS, and basic branding (logo and colors).
[Authenticate] Platform & Security
- [Authenticate] HYPR Enterprise Passkey: Deployment and enablement improvements for broader adoption, including new documentation and support for early adopters.
- [Authenticate] HYPR Enterprise Passkey: Entra ID FIDO2 Provisioning APIs are now generally available, with improved user experience.
- [Authenticate] HYPR Enterprise Passkey: Tap-to-Login user experience enhancements, including roaming support and improved consistency across device types.
- [Authenticate] HYPR Enterprise Passkey: Expanded offline use cases, supporting secure access even when devices are not connected.
- [Authenticate] HYPR Enterprise Passkey: Added support for third-party passkey providers on mobile platforms.
- [Authenticate] HYPR Enterprise Passkey: Improved web and mobile registration experience for single registration flows.
- [Authenticate] iOS: Improved performance and reliability by porting features to SQL DB.
- [Authenticate] Added dashboards and monitoring for major features (Single Registration, Hyprlinks, Security Keys) to improve visibility and proactive alerting.
- [Authenticate] Improved UI for Android login via embedded browser, making authentication smoother when using apps like Office365.
- [Authenticate] Added support for native camera QR code scanning via dynamic short links, allowing users to authenticate faster by scanning QR codes directly with their device camera.
- [Authenticate] Basic branding customization for macOS, enabling administrators to set application icon, name, background image, and logo for a more consistent corporate identity.
- [Authenticate] WFA user interface improvements, including updated "Need assistance" and "Contact support" links for a better support experience.
- [Authenticate] Security device enhancements for macOS, including touch policy for YubiKey and configurable security device lockout number.
- [Authenticate] Support for HID smart cards in WFA for Windows, including Crescendo 2300 and 4000 cards.
[Platform & Control Center]
- [Platform & Control Center] OAuth API Tokens: Expanded OAuth access token support across the entire Control Center, improving security and integration for API access.
- [Platform & Control Center] Oracle Database Support: Added support for Oracle as a backend database, including RDS Oracle deployment, GoldenGate integration, improved schema consistency, migration tools, and enhanced integration test coverage.

Bug Fixes

[Affirm] User Experience & Workflow
- [Affirm] Fixed: Help Desk application now loads data correctly for approved flows.
- [Affirm] Fixed: Wording issues on phone number/email verification in Control Center UI.
- [Affirm] Fixed: Branding in Keycloak now works when using only a background without a logo.
- [Affirm] Fixed: Session failures after user is denied and reenters information.
- [Affirm] Fixed: Inline registration screen flashing during in-line registration in Keycloak.
- [Affirm] Fixed: Logo aspect ratio is now maintained in Affirm custom branding.
- [Affirm] Fixed: Continue button now appears correctly after approver leaves chat or refreshes the page.
- [Affirm] Fixed: Extra quotation mark removed from "could not send a message to you" email screen.
- [Affirm] Fixed: Invalid configuration where the other approver is the requester now throws an error and prevents flow completion.
- [Affirm] Fixed: Updating another approver with a phone number now saves correctly without requiring an email change.
- [Affirm] Fixed: New device email now uses user.namedUser if available instead of user.email.
- [Affirm] Fixed: Typo corrected in identity verification results and approver screens.
- [Affirm] Fixed: OIDC advanced configuration now displays a more helpful error message for invalid URLs.
- [Affirm] Fixed: UI no longer displays the word "Checkbox" when creating a new OIDC PKC checkbox.
- [Affirm] Fixed: Access level for role-less IDP assigned users is now displayed correctly in Control Center.
- [Affirm] Fixed: DM outcome now works correctly when code customization returns a custom login ID.
- [Affirm] Fixed: Numbers on SMS send time are now displayed correctly.
- [Affirm] Fixed: Approver type "manager" is now allowed when rpAppId is empty and userDirectory code customization is in place.
[Authenticate] Platform & Security
- [Authenticate] Fixed: Registration flow may fail with Azure rpApp on a non-Azure, on-prem AD VM logged in with a domain user.
- [Authenticate] Fixed: After fresh installation, registration may fail for the first few attempts.
- [Authenticate] Fixed: Roaming for Enterprise Passkeys now works as expected.
- [Authenticate] Fixed: WFA fails to launch and crashes in specific Windows environments.
- [Authenticate] Fixed: HyprUnlock may be unable to open FIDO2 HID device after extended uptime or sleep.
- [Authenticate] Fixed: Hybrid registration may fail for a specific hybrid user type.
- [Authenticate] Fixed: Deregistering a device from WFA may generate an incorrect event type.
- [Authenticate] Fixed: Authenticator not registered error may be displayed during unlock for valid registration on Entra Only WS.
- [Authenticate - Android] Fixed: App may crash when navigating to web paired accounts after registration with single registration enabled tenant.
- [Authenticate - Android] Fixed: Enterprise Passkey registration can vanish from "My computer" screen unexpectedly.
- [Authenticate - Android] Fixed: Cannot register passkey with Microsoft or webauthn.io and app may crash when scanning QR from desktop.
- [Authenticate - iOS] Fixed: Enterprise Passkey unlock may fail and throw "Authentication failed" error.
- [Authenticate - iOS] Fixed: Version control enforcement policy issues during registration.
- [Authenticate - iOS] Fixed: Alert with missing content may be displayed during registration when enforcement policy is set for current date.

10.0.0 - GA 2025-02-12

Enhancements

[Adapt] Feature Requests
- [Adapt] Show Logging Only flag value in the Policy details drawer
- [Adapt] Store the OAuth2 CrowdStrike API key in Adapt for calls
- [Adapt] Fixed: CrowdStrike IdP Policy evaluation IdP score check is not working as expected
- [Adapt] Fixed: ZTA policy enhancement fires STORED_API_ZERO_TRUST_ASSESSMENT whenever ZTA score is manually retrieved
- [Adapt] Fixed: Crowdstrike policies allowed=true when unable to obtain score
- [Adapt] Fixed: Logging Only Enabled/Disabled status is not tracked in the Audit Trail
- [Adapt] Fixed: CrowdStrike Signal Handler: Add Bulk API call to cover ZTA machine statuses for user web calls
[Adapt] General Improvements
- [Adapt] Consolidate policy evaluation calls in Keycloak Select Login Method module
- [Adapt] Policy assignment event should be tagged as ADAPT_POLICY_ASSIGNMENT and should have policyName
- [Adapt] Add tests for the Login Limits template
- [Adapt] Create diagrams/documentation notes for Firebase KT
- [Adapt] Fixed: Policy / Handler search doesn't work with ID, works only with name
[Adapt] Risk policy chaining PoC
- [Adapt] Composite policy chaining
[Adapt] UI/UX Updates
- [Adapt] Decrease width of version selection field
- [Adapt] Run a new signal search on username change
- [Adapt] Enable searching in the Rego editor
- [Adapt] Confirm exit on unsaved changes
- [Adapt] Prompt for configuration Save upon form change
- [Adapt] Add a refresh button for Signal Handler metrics
- [Adapt] Signal Handler metrics: UX feedback points
- [Adapt] Signal Handler metrics: Info icon with rollover text explaining the use and source of the metric
- [Adapt] Fixed: Manual evaluation input gets overridden on evaluation request
[Affirm] Feature Requests
- [Affirm] Add resource field to OIDC
- [Affirm] Add resource field to OIDC in the UI
- [Affirm] Add an outcome option to redirect on failure
- [Affirm] Add Consent screen
[Affirm] Workflow Friction level for predefined Verification Step templates
- [Affirm] Create the new Friction enum and add it to the UI
- [Affirm] Create workflow defaults by Friction
[Affirm; Integrations; Platform - Keycloak] Keycloak, Affirm and Integrations-related tasks
- [Affirm] Add unit tests to AffirmUserService.kt
- [Affirm] When creating a new workflow, force the user into the full modal
[All HYPR] UX/UI component library updates
- [All HYPR] Generate build of component library
[Passwordless for Windows] Security Device Enhancements
- [Passwordless for Windows] Show smart card device type at registration
- [Passwordless for Windows] Touch policy for YubiKey (presence verification)
- [Passwordless for Windows] Configurable security device lockout number
- [Passwordless for Windows] Fixed: Not getting firmware version from Feitian keys
- [Passwordless for Windows] Fixed: When Smart Card Pairing Enabled is disabled, we cannot pair an IDEMIA card
[Passwordless for Windows] Tech Debt Q1 2025
- [Passwordless for Windows] Change default so HyprKsp does NOT do CRL and user account checks
- [Passwordless for Windows] Extend copyright year to 2025
- [Passwordless for Windows] Fixed: HyprServiceInstallError system environment variable may be set following the Passwordless client installation
- [Passwordless for Windows] Fixed: Checking wrong error code after DiInstallDriver
[SDK for FIDO2 Web Browser] HYPR FIDO2 Web SDK Improvements 10.0
- [SDK for FIDO2 Web Browser] Consolidate Type imports
[Adapt ] Event Handlers Beta
[Adapt] Logging facility for Policies
[Adapt] Risk and Signal Handler versioning Template [Backend]
[Control Center - Integrations] Enterprise Passkey: Third-party passkey provider API for macOS [Alpha]
[Mobile App for Android] Current profile improvements: MachineStatus and token refresh
[Mobile App for Android] Hyprlinks: sample code reference app
[Mobile App for Android] Provide responses for MASA revalidation
[Mobile App for iOS] Update EULA text
[Passwordless for Windows] Update EULA text on the workstation client
[Platform - Keycloak] Keycloak to send authenticated events

Bug Fixes

[Passwordless for macOS] Q2 2025 Security Device Enhancements
- [Passwordless for macOS] Fixed: Cannot set "securityKeyPinComplexity" in hypr.json
- [Passwordless for macOS] Fixed: Passwordless doesn't enforce PIN Complexity
[Affirm] Integration Bug Fixes
- [Affirm] Fixed: Control Center UI Verification Flows table Description sort leads to a white screen
- [Affirm] Fixed: Generic error when updating verification flow that isn't assigned an rpAppId
- [Affirm] Fixed: After the Consent screen, instead of redirecting to chat, it redirects to the Control Center login page
- [Control Center - Integrations] Fixed: Azure: All three transport types are may be successfully disabled
[Adapt ] The risk policy name is displayed as 'NA' in the Integrations page when the policy is deleted
[Login Limits Policy] The user remains blocked even after the User Blocked Duration is configured
[Passwordless - Both] QR_Fallback: QR icon is large in size when compared to the line of text
[Passwordless for Windows] Fix warning introduced

9.7.2 - GA 2025-02-07

Enhancements

[Affirm] PoC: Helpdesk Support
[Affirm] Helpdesk CC UI Changes
[Affirm] Helpdesk endpoint details UI
[Affirm] Helpdesk endpoint main table UI
[Affirm] Helpdesk IdV UI changes
[Affirm] Helpdesk PoC - combine/connect the web UI all together
[Affirm] Helpdesk scaffolding code for the new endpoint
[Affirm] New feature flag for Help Desk functionality
[Affirm; Integrations; Platform] Q1/2025 Keycloak, Affirm and Integrations related tasks
[Integrations - Entra] Use the Keycloak url from vault
[Integrations - Okta] Don't assign an application when adding a device
[Mobile App - Both] Make SMS keyword responses adhere to convention (stop, help, etc.)

Bug Fixes

[Entra] Federation: After updating the password of a service account, users can no longer authenticate

9.7.1 - GA 2025-01-07

Enhancements

[Adapt] Additional CrowdStrike functionality and fixes
- [Adapt] Store OAuth2 CrowdStrike API Key in Adapt for calls
- [Adapt] Fixed: ZTA policy enhancement: Fire INBOUND_EVENT_HOOK whenever the CrowdStrike ZTA score is manually retrieved
- [Adapt] Fixed: Crowdstrike IdP Policy: The evaluation IDP score check is not working as expected
- [Adapt] Fixed: Add Bulk API call to cover CrowdStrike ZTA machine status for user web calls
- [Adapt] Fixed: CrowdStrike policies allowed=true when unable to obtain score
- [Adapt] Fixed: CrowdStrike IdP Policy: Policy evaluation failed due to error 'failed to create policy evaluation context'
- [Adapt] Fixed: CrowdStrike ZTA policy: Previously generated STORED_API_ZERO_TRUST_ASSESSMENT is not being used for policy eval
[Affirm] Third party jars/tools production readiness tasks
- [Affirm] Add SMS reference data
- [Affirm] Use the latest pinpoint SDK (version 2)
- [Affirm] Configure rate limits
- [Affirm] Update IAM policy for accessing end-user messaging API
[All HYPR] Observability Tasks
- [API] Enhance API Tokens Traceability
- [Control Center] Consistent server request logging
- [Errors] DBMigration service logs should use the 'Info' log level instead of the 'Error' log level
- [Events] Define Event information requirements
- [Events] FIDO_ONLY_AUTH and FIDO_ONLY_REG attempts do not have an associated COMPLETE event
- [Events] Saving an Event failure should not fail flows
- [Errors] Fixed: Remove error codes for successful Event logs
- [Events] Fixed: The deviceId is null in Event logs when other device data is known
[All HYPR] Use same traceId for reg process
[Mobile App - Android] QR Code handling of additional parameters
- [Mobile App for Android] Custom field added to qrpayload
[Passwordless - Both; API] Workstation thundering herd mitigation
- [API] Move security key last used date to batching
- [Control Center; API] Block or throttle selected Control Center calls
- [Passwordless - Both] Mitigate workstation Audit call flood
- [Passwordless - Both] Workstation status warm session cache needs optimization
[Platform - Keycloak] Protect against Evilnginx first phase
- [Platform] Confirm that protections against Evilnginx will work in production

Bug Fixes

[Affirm; Control Center - Integrations] Q1/2025 bugs fixed
- [Affirm] Fixed: Switching approver to HYPR from Manager is not taking still get emails and texts
- [Affirm] Fixed: The results API returns a query when invalid/nonexistent workflowId is provided
- [Affirm] Fixed: Code Customizations: ACCEPT and CONTENT_TYPE headers are being appended twice
- [Affirm] Fixed: A blank page appears because of a React error when the user selects a value from the Type dropdown in the Affirm Approver Management page
- [Control Center] Fixed: Adding a Control Center admin user shows on both the Registered and Pending lists
- [Control Center] Fixed: After successful registration on mobile using a passkey, the passkey is not displayed
- [Control Center - Integrations] Fixed: Okta: Two users with same email; only one is able to register with HYPR
[Adapt] Fixed: Signal Handlers: TOR Data Collector handler times out when a signal is triggered
[Affirm] Fixed: Add better logging to Affirm for production releases
[API] Fixed: /rp/wsapi/securitykey/updatepinreset returns 200 with invalid existingPuk
[Control Center - Integrations] Fixed: HYPR Enterprise Passkey: Double user presence (UP) prompt periodically occurs during authentication
[Control Center - Integrations] Fixed: HYPR Enterprise Passkey: Unexpected signature counter received
[Mobile App for iOS] Fixed: Web-to-workstation QR scan to login fails with 1202006

9.7.0 - GA 2024-12-11

New Features and Feature Changes

[Adapt] Implement Adapt for Workstation - Beta
[Adapt] Policy & Signal Handler UI v9.7 Cleanup
- [Adapt] Login Limits Policy Unit Test
- [Adapt] Signal Handlers: Template and tests organization
- [Adapt] Fixed: Login limits policy allows negative values in the config and the policy evaluation fails
- [Adapt] Fixed: Signal Handlers: Values flicker when the mouse is hovered on the success or failure percentage tooltip
[Adapt] UX Updates II
- [Adapt] Add version tags to templates
- [Adapt] Enhance Signal Handler Error Details
- [Adapt] Add View Raw option for signal search results
- [Adapt] Add Search by Signal Handler button
- [Adapt] Saved Event View in Signal Search
- [Adapt] Add Console Log Pane to Policy Test Page
- [Adapt] Revert code view change for built-in entities
- [Adapt] Policy Config Form - Support Textarea field
- [Adapt] UI - Update Doc Portal
- [Adapt] Signal Handlers page should show the pipeline - i.e. Sort by Status, Priority & then Last Modified
- [Adapt] Signal Handler Metrics - UX feedback items
- [Adapt] Fixed: ‘Policy Assignments Updated’ success message interrupts the Policy assignment
- [Adapt] Fixed: The exceptions for date selection in the Signal Search page aren't handled properly, which leads to an empty page being displayed
[Affirm] Control Center login first time Admin with Affirm
- [Affirm] Remove AffirmUserService.kt from all sonar exclusions
[Affirm] Custom Workflow Enhancements & Management in UI
- [Affirm] Back End: Create an end point to allow the UI to get all the available workflows
- [Affirm] Remove Application Setup Tab
- [Affirm] Front End: Add the verifications flow tab table
- [Affirm] Update workflow drawer UI
- [Affirm] Select a workflow step in the drawer should zoom into the step in the modal
- [Affirm] Workflow Modal: Save and revert should work per tab
- [Affirm] Remove the first step of the web UI
[Affirm; Control Center - Integrations] Q4/2024 Integrations and Affirm bug fixes and unplanned work
- [Adapt; Events] Add 'locationIpDistance=' and 'locationReverseGeocodeDistance=' to GOOGLE_LOCATION_ADDRESS operation payloads
- [Affirm] Add logins to logs for Affirm to help get info for debugging and future issues
- [Affirm] Upgrade/migration path to populate missing values in new Affirm table
- [Affirm] If only 1 Approver/escalation Approver is listed, do not show a timeout
- [Affirm] Add close button to verification flow modal
- [Affirm] Lint & Format affirm cc ui code to be in unison with proper configs.
- [Control Center] Email templates need to be updated with the new office information
- [Platform - Keycloak] Authenticator page text changes
- [Affirm] Fixed: if user is stuck in the upload document we should time out after a set amount of time
- [Control Center] Fixed: Deleting a Control Center user deletes the user but shows an error in the model and both a success and failure message on Control Center
- [Affirm] Fixed: Some users are not able to type in the chat and are not able to click on the type here to chat
- [Affirm] Fixed: API missing "status": and "type": for new table flows
- [Affirm] Fixed: Approver chat is not loading for requester or approver
- [Affirm] Fixed: Creating a flow via the API in 9.7 does not allow "OUTCOME_STEP_REDIRECT_URL": "Dynamic
- [Affirm] Fixed: Cannot create a workflow approver time must be 0 for last approver
- [Affirm] Fixed: Data too long for column error and 500 internal error
- [Affirm] Fixed: Lock header and footer in place for the model
- [Affirm] Fixed: CC Admin flow unable to register device/ 500 on device registration
- [Affirm] Fixed: Twilio video no longer loading for affirm on Firefox/Edge
- [Affirm] Fixed: Workflow Inactive/active does nothing flows can be run in either state
- [Affirm] Fixed: Entering nothing in the input field for text messages verification number goes to site cannot be reached
- [Affirm] Fixed: Better UX around the please wait screens
- [Affirm] Fixed: Better wording around the text received by users with the verification code
- [Affirm] Fixed: Better branded error messages for 403 errors after a link is clicked
- [Affirm] Fixed: OIDC approver not persisting after save on new table
- [Affirm] Fixed: Attempting to select type on affirm new table shows under applications when selected
- [Affirm] Fixed: Better error message around missing type
- [Affirm] Fixed: 2 approvers are able to join the chat
- [Affirm] Fixed: Remove assigned approvers if escalate to live chat is inactive - don't allow add escalation approver to be added unless it is active
- [Affirm] Fixed: With no data present - on advanced customizations we are showing them on the workflow management as active when they are not
- [Affirm] Fixed: Deleting last workflow causes user not to be able to close the slider and can delete an empty workflow
- [Affirm] Fixed: Remove the 'this link expires in time' from the approver email.
- [Affirm] Fixed: Set timeouts for approvers saved at 5 minutes on save are set to 0 minutes
- [Affirm] Fixed: CC Admin second flow being added to a tenant where a CC admin flow exists for the tenant throws a null pointer
- [Affirm] Fixed: Approvers missing on the slider view
- [Affirm] Fixed: Workflow validation for if HYPR approver is required says approver type none
- [Affirm] Fixed: When turning off escalation approvers when should clean up the existing approvers to not confuse the user
- [Affirm] Fixed: Change status for rotation /cc/ui/idv/verify/document-upload-video to not be error
- [Affirm] Fixed: "null" String value as oidcClientConfigId in Approvers
- [Affirm] Fixed: Error when saving workflow after adding escalate to live chat
- [Affirm] Fixed: Creating customization and then opening modal, will not re-fetch list, but instead user needs to refresh the page
- [Control Center] Fixed: User Management: Can't create/delete admin users
- [Control Center] Fixed: Branding: UI on QR auth and QR fallback pages has HYPR style showing
- [Control Center] Fixed: Device Manager: Scan the QR code icon in the instructions; the QR is able to be picked up by camera
- [Control Center] Fixed: Fix the email to match the re-worked design
- [Control Center - Integrations] Fixed: Okta: Manually sending invite to a fake user leads to a server error
- [Control Center - Integrations] Fixed: Okta: Two users with same primary email, but different usernames, both get assigned to the Okta app
- [Control Center - Integrations] Fixed: Okta: Control Center showing blank error after failed attempt to add an Okta integration
- [Control Center - Integrations] Fixed: Okta: IDP provider is created/not deleted during failed attempts to add the integration
- [Platform] Fixed: Validation error in Datadog after brute force attempt
- [Keycloak] Fixed: NullPointerException when running with debug log in the old authenticator
- [Platform - Keycloak; Mobile App for Android] Fixed: Keycloak UI: Poor UX for Android user-agent to Android device.
- [Platform - Database] Fixed: Oracle-incompatible database migration
[All HYPR] Customer Issues Brought In
- [All HYPR] Single Registration: Web-to-Workstation: Extend validity of the FIDO session to cover enrolment/complete step on slow environments
- [All HYPR] Address server CVE
- [Control Center] Find a way to not have feature enabled for controlCenterAdmin
- [Mobile App for Android] Current Profile Improvements - Phase 1
- [Passwordless for Windows] Adjust SSO command line parsing to allow for Chrome breaking our URL
- [Control Center; Passwordless - Both] Fixed: InternalServerErrorException error returned for settings call
- [Passwordless for Windows] Fixed: Locale mismatch leads to invalid certificate expiration reported to CC
- [Passwordless for Windows] Fixed: Unlock fails with "Bad username or password" for a local user account when running in an RDP session
[All HYPR] Q4 2024 Authenticate Application Security Items
- [Platform] Redis: Encrypt ML
[All HYPR] Q4 2024 Branding and Customization
- [Affirm; Control Center] Back End: Adjust branding interceptor (CC/Affirm/DM) to enable disable branding based on the product calling it
- [Control Center] Front End: Fix responsiveness of cards and forms + handle loading states & error states in a nicer way
- [Control Center] Back End: Fix existing Device Manager data to use the correct end point
- [Control Center; API] Front End: Add Typescript support + switch api calls to use RTK for Custom Branding sections
- [Mobile App - Both] Back End: Add Mobile section to the customization
- [Mobile App - Both] Back End: Add Mobile section to the customization
- [Platform - Keycloak] Back End: Bring Logo and Background to Keycloak
- [Platform - Keycloak] Back End: Adjust Keycloak logic x branding by the enableLogoAndBgForKC flag
- [Platform - Keycloak] Keycloak branding customization should apply to all dialogs, not just the initial one.
[Control Center - Integrations] Entra: EAM Integration - Beta
- [Control Center - Integrations] Code cleanup around Entra integration
- [Control Center - Integrations] External Authentication Methods: Integration is enabled despite error message
[Control Center - Integrations] Entra: User Management Authenticator Removal
- [Control Center] UI: Use Generic User Management component in v1 Control Center users
- [Control Center] Settings: Use Generic User Management component
- [Control Center - Integrations] User Management: Paired with Azure: Display option to "Remove Workstation" or "Remove Web Domain" from mobile device
- [Control Center - Integrations] User Management: Paired with HYPR/Enrolled: Display option to "Remove Workstation" or "Remove Web Domain" from mobile device
[Control Center - Integrations] HYPR Enterprise Passkey: Tap to Login UX PoC
[Control Center - Integrations] Okta: Inline registration
- [Control Center - Integrations] Okta: Create the integration
[Control Center; Platform] UX/UI Auxiliary - v9.7
- [Platform] HYPR UI Component Library: Upgrade to Storybook 8
- [Control Center] Workstation Settings: Require User Presence UI
[Passwordless - Both] Q4 2024 Passwordless UI Improvements
- [Passwordless for Windows] Remove Desktop SSO "success" notification
[Passwordless - Both] Security Device Enhancements - Q4 2024
- [Control Center] HYPR IE SmartCard Hook not provided the type of the card
- [Passwordless for macOS] HYPR IE SmartCard Hook not provide type of the card
- [Passwordless for macOS] Security Key pre-registration hook before certificate is requested
- [Passwordless for Windows] Client doesn't enforce PIN complexity
- [Passwordless for Windows] Fixed: Unable to enter current PIN with special characters if securityKeyPinCharacters is not Any
- [Passwordless for Windows] Fixed: Deleting a fingerprint from the middle of the list doesn't re-order the rest of the list
- [Passwordless for Windows] Fixed: Security key registration is successful without entering values in New PIN and Confirm New PIN fields
[Passwordless for Windows] Passwordless Tech Debt Q4 2024
- [Passwordless for Windows] Fix build of PairedDevices tool
[Passwordless for Windows] (PUK) Security Device Unlock Code Support
- [Passwordless for Windows; API] Send "deletePuk" option in /rp/wsapi/smartkey/unenroll API
- [Passwordless for Windows] Multiple small fixes for Passwordless 9.5.1
- [Passwordless for Windows] Improve setting new PUK during security key enrollment
- [Passwordless for Windows] Client doesn't allow Feitian/YubiKey key to be reset when the wrong PUK is entered.
- [Passwordless for Windows] Server seems to give the wrong PUK or the client isn't accepting the right PUK
- [Passwordless for Windows] Client doesn't show UI to obtain PUK when we lock PIN through unpair workflow
- [Passwordless for Windows] Unable to unlock YubiKey with old firmware's using PUK
[Platform] Ops Tasks
- [Platform] Deploy latest 9.5 image for EOG
- [Platform] Enable Adapt signals for EOG tenants
[Platform - Keycloak] Q4 2024 Keycloak module improvements
- [API] Use POST instead of GET for usernames
- [Control Center - Integrations; Platform - Keycloak] Update code to use the new keycloak.fqdn address for Keycloak access
- [Platform - Keycloak] Upgrade to the latest Keycloak 25
[SDK for iOS] Mobile SDK Size Reduction - Implementation
- [SDK for iOS] Remove Cached Audit Event Mechanism

Enhancements

[Adapt] Inbound Event hooks ingestion
[Adapt] JSONDecodeError WEBAUTHN event
[Adapt] Signal Handlers: Add more functions to the ctx API
[Adapt; Documentation] Articles review and improvement/update
[Adapt; Platform - Keycloak] Hardening II - v9.7
[API] Switch /checksettings request justVerifySerialNumber to justValidateSerialNumber
[Control Center] (PUK) Security Device Unlock Code Support
[Control Center - Integrations] AD FS Plugin v2: Add support for Desktop SSO/HYPRSpeed
[Control Center - Integrations] HYPR Enterprise Passkey: Entra ID FIDO2 Provisioning APIs Security Hardening Integrations - Beta
[Mobile App - Both] Transaction Extras in QR code
[Mobile App for Android] Single Registration: Call status/registration when needed every time the app starts (instead of relying on Fallback button)
[Passwordless for Windows] Figure out PRT Validation

Bug Fixes

[Adapt] Bug Fixes
- [Adapt] Fixed: Exclude untrusted events
- [Adapt] Fixed: Evaluation Response Unavailable on Fallback Assignments appears null for old assignments
- [Adapt] Fixed: The attribute "eventTags" in the /cc/ui/audit/search call has "HYPR CC" or "KC" text appended to existing value
- [Adapt] Fixed: CrowdStrike event gets stored with eventName as 'null'
- [Adapt] Fixed: Policy home page > Assign policy: No RP App Evaluation Points to choose from
- [Adapt] Fixed: Missing/misformatted fields in ADAPT_POLICY_EVAL_USER_BLOCKED events
- [Adapt] Fixed: Events aren't valid JSON and are failing to route to the Event bus
- [Adapt; Control Center - Integrations] Fixed: Okta inbound hook handler code has undefined object error
[Adapt] Fixed: Signal Handlers: Crowdstrike: HMACTestSecretKey works only for one of the test Events
[All HYPR] Fixed: Single Registration: We don't see Recovery PINs for iOS/Android
[Control Center] Fixed: Custom Branding: Device Manager redirect URL not saving on Control Center, and not seeing the prompt or redirect link on Device Manager
[Events] Fixed: Traceids are not consistent through Enterprise Passkey Event flow
[Mobile App for Android] Fixed: Enterprise Passkey: User presence prompt contents are being read incorrectly
[Passwordless for Windows] Fixed: Enterprise Passkey: Accessibility: Incorrect element being read on the on Entra pairing success screen
[Passwordless for Windows] Fixed: Enterprise Passkey: Accessibility: Name property for the buttons are null in Wi-Fi/BLE selection screen
[Passwordless for Windows] Fixed: Intermittent issue with the client UI when we delete YubiKey registration with the API

9.5.3 - Patch 2024-11-18

Enhancements

[Passwordless for Windows][ Create fully independent messages for PIN unlock
[Control Center - Integrations] Okta: Allow confguration of user removal from an Okta application

Bug Fixes

[Affirm] Using customized email leads to an invalid link while inviting user to chat

9.5.2 - Patch 2024-11-01

New Features and Feature Changes

[Adapt] General Improvements
- [Adapt] Exclude untrusted Events
- [Adapt] Add the version bump code to the Risk engine pom
- Bug Fixes:
  - [Adapt] Fixed: Unable to deploy 9.5.2 Risk engine to STG environment due to auto-bump issue
  - [Adapt] Fixed: Missing/misformatted fields in ADAPT_POLICY_EVAL_USER_BLOCKED Events
  - [Adapt] Fixed: Events aren't valid JSON and are failing to route to the Event bus
  - [Control Center; API; Events] The attribute "eventTags" in /cc/ui/audit/search call has "HYPR CC" or "KC" text appended to existing value
[Adapt] Solve JSONDecodeError when parsing Events
- [Adapt] Fixed: JSONDecodeError WEBAUTHN Event
- [Adapt] Fixed: JSON Parsing: investigate and solve AttributeError
[Platform] Ops Tasks
- [Platform] Deploy latest 9.5 image for EOG
- [Platform] Enable Adapt signals for EOG tenants

Enhancements

[Adapt] Push is treated as an allowed authenticator under the Login Limits policy if QR is configured
[Control Center] During upgrade, uaftxn expiration loop defenses
[Passwordless for Windows; Platform; Keycloak] Desktop SSO: Remove "Logging in just got easier" screen from Keycloak
[Passwordless for Windows] De-registration success text can be customized
[Passwordless for Windows] Remove Desktop SSO "success" notification
[Passwordless for Windows; API] Include Passwordless activity in smartkey/checksettings request payload

Bug Fixes

[Affirm] Fixed: Flows with no configured rpAppId using custom directory source data Events are not making it to the Audit Trail

9.6.0 - GA 2024-10-01

New Features and Feature Changes

[Adapt] UI (Phase 4)
- [Adapt] Adapt Unavailable feedback: Display a warning message that for all the users Authentication would be blocked
- [Adapt] Allow user to change time period of Signal Handler metrics
- [Adapt] Custom policy secret values instructions are missing
- [Adapt] Dedicated Signal Search UI
- [Adapt] Set icons for Signal Handler templates
- [Adapt] Signal Handler metrics overview
- [Adapt] Update RP App Policy assignment table
[Affirm] Custom Workflow Enhancements and Management in UI
- [Affirm] Custom Outcome if denied
- [Affirm] Connect between custom user directory/SMS/Email and the rpApp selection in the UI
- [Affirm] Connect between the OIDC and the Requester/Approver in the UI
[All HYPR] UX/UI Auxiliary I
- [All HYPR] UI Accessibility Checklist
- [Control Center] Update Control Center UI Gitlab README

Enhancements

[Adapt] Add Signal Handler tests
[Adapt] Crowdstrike Inbound Webhook: Need 2 HMAC keys for both the Signal Handler and test Event to work
[Adapt] Risk Reports: Replace policyID column name to policyName
[Adapt] Signal Handlers Test tab: rename the ‘Test’ tab and disable the Code tab; but still show the code for 'Builtin' type
[Adapt] Signal Handlers: Add templates for Event Enricher
[Affirm] Upgrade to the latest OnFIDO
[Control Center] Create device registration notification enablement
[Control Center] Custom Branding: Adjust Logo and Background section to contain toggles that enable/disable branding by product
[Control Center] Device Manager: Unauthorized DELETE call
[Control Center] Inline Registration: create Enablement
[Control Center] Send an email when a user create/pair new device
[Control Center - Integrations] Entra EAM: Username should be pre-populated
[Passwordless for macOS] Add extra logging to detect TouchID usage from OS before displaying unlock dialog
[Passwordless for Windows] HYPR IE SmartCard Hook not provide type of the card
[Passwordless for Windows] Password Prompt Removal for Windows - PoC/Alpha
[Platform - Keycloak] Custom migration for existing tenant to move Azure integration to use the new Keycloak SAML flow/authenticators
[SDKs for Android and iOS] Mobile SDK Size Reduction

Bug Fixes

[Adapt] Fixed: Risk Reports Events are not sorted by eventTimeInUTC column
[Affirm] Fixed: Escalation approver should not have automated approver as an option
[Control Center] Fixed: Settings user table alignment on username and email are misaligned, higher than the others
[Mobile App for Android] Fixed: Enterprise Passkey: Android stops issuing the /deviceapi/fido2/receive calls on trying to register Security key again after de-registering previous Entra pairing
[Mobile App for Android] Fixed: Transaction Flow Fails to Render Activity Screen
[Passwordless for macOS] Fixed: Failed to contact Certificate Authority if user is accessing a shared folder
[Passwordless for macOS] Fixed: QR Fallback: rpApp name is cut on Passwordless dialog if tenant name is too long
[Platform - Keycloak] Fixed: Select your login page ^ covers text on screen while hovering over the HYPR Mobile App

9.5.0 - GA 2024-09-12

New Features and Feature Changes

[Adapt] Crowdstrike - Beta
- [Control Center - Integrations] Create Adapt Policy for Crowdstrike
- [Control Center - Integrations] Create Tests for Crowdstrike Service
- [Control Center - Integrations; Adapt] Improve Crowdstrike Policies description, policy evaluation messages
- [Control Center - Integrations; API] Create Service for Crowdstrike API
- Bug Fixes:
  - [Adapt] CrowdStrike and Okta Signal Handlers: Name update and parsing error in handler code
  - [Adapt] Crowdstrike ZTA policy: Workstation Unlock fails as there is no ZTA score retrieved
  - [Adapt] CrowdStrike ZTA policy doesn't fail if the score threshold difference is '0.5'
  - [Adapt; API] Crowdstrike Policies: CrowdStrike API field is not secret and API calls fail if the field is made as a secret
  - [Platform - Vault; Adapt] Adapt webhook fails because 'hypr.cc.crowdStrikeWebHookKey' gets removed after updating the Control Center image
[Adapt] Policy and Signal Handler UI (Phase 3)
- [Adapt] Policies: Add Support For Managing Policy Assignments in Policy Configuration
- [Adapt] Policies: Create Test Pane for Built-in Policies
- [Adapt] Policies: Update Creation Flow
- [Adapt] Policies: Update Table View
- [Adapt] Risk policy and Signal Handlers: Add 'Date created' column
- [Adapt] Signal Handlers: Scroll not visible, View logs button name change, add handler type info
- [Adapt] Signal Handlers: Test Tab: In the Sample Signal dropdown, the first item in the dropdown should be selected by default
- [Adapt] Signal Handlers, Policies: Replace 'Event' with 'Signal'
- [Adapt] Signal Handlers: Add Invocation Metrics
- [Adapt] Signal Handlers: Add Status Badge to Configuration Page
- [Adapt] Signal Handlers: Add templates for Action Executor type
- [Adapt] Signal Handlers: Add Versioning Support
- [Adapt] Signal Handlers: Rename "Event Handlers" to "Signal Handlers"
- [Adapt] Signal Handlers: Test data should match the test data from signal handler template
- [Adapt] Signal Handlers: Test tab 'Send Event' button
- [Adapt] Signal Handlers: Update Code Pane
- [Adapt] Signal Handlers: Update Creation Flow
- [Adapt] Signal Handlers: Update Table View
- [Adapt] UI Post Product Review Fixes
- [Adapt] UI Technical debt
- [Adapt] Update Landing Page
- [Adapt; API] Signal Handlers: API to support UI changes
- [Adapt; Documentation] Create articles for Signal Handlers and Risk Policy templates
- Bug Fixes:
  - [Adapt] Fixed: Data collector Signal Handler gets invoked as per cron schedule but doesn't execute the code
  - [Adapt] Fixed: Signal Handlers: Add documentation for Signal handlers
  - [Adapt] Fixed: Signal Handlers: AWS ARN info is displayed in the logs
  - [Adapt] Fixed: Signal Handlers: BUILT_IN_SAVE_EV_HANDLER doesn't always execute if one of the handler executions fails
  - [Adapt] Fixed: Signal Handlers: Configuration fields are missing
  - [Adapt] Fixed: Signal Handlers: Cron schedule link broken and Control Center logs issue
  - [Adapt] Fixed: Signal Handlers: Error logs are not shown on the UI
  - [Adapt] Fixed: Signal Handlers: Existing Signal Enricher handler is getting executed when it is not expected
  - [Adapt] Fixed: Signal Handlers: New signal handlers gets executed in regular intervals even though there is no cron schedule set
  - [Adapt] Fixed: Signal Handlers: Some of the handlers take longer than 6s and don't get processed
  - [Adapt] Fixed: Signal Handlers: The clear assignments pop-up is not responsive
  - [Adapt] Fixed: Signal Handlers: User unfriendly error message is displayed when there is no data
  - [Adapt] Fixed: UI Code Editing Broken
  - [Adapt; Documentation] Fixed: Welcome screen: Create policy documentation link is broken
[Affirm] Outcome: Microsoft Verified ID
- [Affirm] Add Outcome for Microsoft Verified ID
[Affirm] Improvements on the way to GA
- [Affirm] Add message to Requester to tell them the continue button has become available
- [Affirm] Add padding to inputs to have better visibility
- [Affirm] Adjust padding in the phone number verification screen in input field to improve visibility
- [Affirm] Align behavior of custom user directory source and standard integration user lookup when 4xx or 5xx
- [Affirm] Change login-id endpoint and FTL template
- [Affirm] Chat input text message field should be the same height as video/send buttons
- [Affirm] Chat window is wider than other windows this should match the rest of the screen
- [Affirm] Check over and make sure the examples for code customizations are correct JS
- [Affirm] Code customizations, optimize Requester/Approver lookups
- [Affirm] Display flow id in the flow UI
- [Affirm] Event for workflow escalation
- [Affirm] Icon missing on Approver screens
- [Affirm] Implement chat escalation process for OnFido IDV failure cases in the verification flow
- [Affirm] Improve error handling in code customization calls
- [Affirm] Make buttons feel more responsive when clicked
- [Affirm] OIDC and other advanced settings UI improvement adding ID
- [Affirm] OnFIDO background is currently blue, change it to white to match the rest of the flow
- [Affirm] Remove Twilio chat and video dependencies from Photo ID and Liveness
- [Affirm] Requester timeout on chat
- [Affirm] Text code message is out of the text block shorten the message.
- [Affirm] Text sizes and fonts for all screens
- [Affirm] UX: Change size of model to better match OnFIDO
- [Affirm] UX: Long Processing
- [Affirm] UX: No user knowledge that the record button has done anything or is attempting to get the image captured
- [Affirm] UX: When a new Approver joins the chat there is no feedback to the Requester that the Approver has changed
- [Affirm; API] Fix Affirm APIs in Arch tests
- [Affirm; Documentation] Article on error handling for code customizations; custom user directory source (no record found, generic error)
- [Affirm; Documentation] Broken Links in the Affirm configuration UI
- [Affirm; Events] Add user role field to Affirm Events
- Bug Fixes:
  - [Affirm] Fixed: Activity Log type says recovery when initiated by the API
  - [Affirm] Fixed: Client secret is not hidden on OIDC settings
  - [Affirm] Fixed: Custom Branding: Large icons cause buttons to break out of the model
  - [Affirm] Fixed: Data mismatch on Activity Log for Approver when secondary Approver approves
  - [Affirm] Fixed: Duplicated records in idv_user_info table when both Approvers and escalation Approvers contain MANAGER or the same SOMEONE_ELSE email
  - [Affirm] Fixed: Escalation Approvers/Approvers are overlapping each other (no distinguishing between Approver being regular/escalated one in idv_user_info table)
  - [Affirm] Fixed: Buttons in both Requester and Approver flow
  - [Affirm] Fixed: Multiple entries in the Activity Log caused by showing a entry per Approver in the Activity Log
  - [Affirm] Fixed: No Approvers were found on workflow error
  - [Affirm] Fixed: When liveness check fails and you are sent to chat escalation the Approver report card does not show the face capture
  - [Affirm; Documentation; API] Fixed: API doc content-type: application/json is missing in all GET requests in Postman JSON
[Affirm] Q4 2024 Integrations and Bug Fixes and Unplanned Work
- [Affirm] Cost tracking details for OnFIDO
- [Affirm] Add dynamic Approvers in the create single user flow API
- Bug Fixes:
  - [Affirm] Fixed: Duplicate workflowId on Approver better error messages and logging
  - [Affirm] Fixed: OIDC for Requester stuck on blank page
  - [Affirm] Fixed: Affirm selfie match going full screen on mobile devices during regression.
  - [Affirm] Fixed: Azure incorrect email error showing incorrect error message
  - [Affirm] Fixed: Adding long strings to the chat
  - [Affirm] Fixed: If time for Approvers is over 10 minutes throw an error on the front end since we now have a 10 minute timeout
[Affirm; Events] Reporting (Enhance reporting features or capabilities, including support for collection of metrics); Event Alignment
- [Affirm; Events] AFFIRM_WORKFLOW_CONFIGURATION_CHANGED Event
- [Affirm; Events] AFFIRM_WORKFLOW_IDV_FINISH Event
- [Affirm; Events] AFFIRM_WORKFLOW_IDV_START Event
- [Affirm; Events] AFFIRM_WORKFLOW_PHONE_NUMBER_ENTERED Event
- [Affirm; Events] APPROVER ACCEPTED INVITE Event
- [Affirm; Events] DOCUMENT UPLOAD Event; photo ID liveness
- [Affirm; Events] OUTCOME TYPE Event
- [Affirm; Events] PARITY API/UI FLOW EDITING Events
- [Affirm; Events] USER STARTS FLOW Event
- [Affirm; Events] VIDEO Event
[Affirm; Control Center] Branding and Customization
- [Affirm] Custom Branding for the Control Center UI
- [Affirm] Custom Branding: Custom Icon - custom icon should be correctly scaled on affirm flows
- [Affirm] Custom Branding: Support custom background URL
- [Control Center] Backend: Device Manager Section
- [Control Center] UI: Device Manager Section
- Bug Fixes:
  - [Affirm] Fixed: Custom Branding: Background color missing # on Hex while parsing to Affirm
  - [Affirm] Fixed: Custom Branding: Background color not accepting HEX characters A-F
  - [Affirm] Fixed: Custom Branding: Background needs to be background; not model background
  - [Affirm] Fixed: Custom Branding: Box sizes are not responsive and can cut off links
  - [Affirm] Fixed: Custom Branding: Hexadecimal color character counter warns when a letter is in the value, and fails to save when there is no warning message
  - [Affirm] Fixed: Custom Branding: Preview for company logo not displaying uploaded image
  - [Affirm] Fixed: Custom Branding: Save buttons in Control Center Settings Custom Branding don't save; Image Upload fails
  - [Affirm] Fixed: Custom Branding: Saving causes 400 on image end point without adding an image
  - [Affirm] Fixed: Custom Branding: When saving logo or background Hex in Control Center the Save button spins
[All HYPR} Single Registration: Web-to-workstation Enhancements - Offline PINs
- [Mobile App for Android] Process signingCert in OfflineAccess object for web registration flow
- Bug Fixes:
  - [Passwordless for macOS] Fixed: Workstation-to-web: Mobile App for Android crashes when unlocking machine after use of Offline PIN
  - [Passwordless for macOS] Fixed: Workstation-to-web: Mobile App for iOS crashes when unlocking machine after use of Offline PIN
[All HYPR] Support native camera QR Code scan via dynamic short links - Beta
- [Control Center] Support Parsing Dynamic Link
- [Mobile App for Android] Support Parsing Dynamic Link
- [Mobile App for iOS] Support Parsing Dynamic Link
[Control Center - Integrations] Entra External Authentication Methods (EAM) Integration [Beta]
- [Control Center - Integrations] Entra EAM: Create feature enablement
- [Control Center - Integrations] Entra EAM: Entra Integration backend; User Management
- [Control Center - Integrations] Entra EAM: Fix integration UI
- [Control Center - Integrations] Entra EAM: Integration backend; Entra artifacts
- [Control Center - Integrations; Documentation] Entra EAM Integration
- [Control Center - Integrations; Events] Entra EAM: Add EAM value to integrationType field in Event logs
- [Control Center - Integrations; Platform - Keycloak] Entra EAM: Entra integration backend; Keycloak artifacts
[Control Center - Integrations] HYPR Enterprise Passkey: Entra ID FIDO2 Provisioning APIs - Beta
- [Documentation] Provisioning API flow
- [Mobile App for Android] Provisioning API UI Updates
- [Mobile App for iOS] Provisioning API UI Updates
- [Passwordless for Windows] Provisioining API UI Updates
- Bug Fixes:
  - [Mobile App for Android] Fixed: Link to Entra Pairing documentation is broken
  - [Mobile App for iOS] Fixed: Link to Entra Pairing documentation is broken
  - [Mobile App for iOS] Fixed: Link to Entra Pairing documentation is broken (again)
  - [Passwordless for Windows] Fixed: Entra Enterprise Passkey pairing prompted for Local/Non-Hybrid AD accounts fails with an error
  - [Passwordless for Windows] Fixed: Entra Enterprise Passkey: Local/Non-Hybrid AD Accounts has 'pairing incomplete/Not fully paired' link, which triggers Entra pairing flow
  - [Passwordless for Windows] Fixed: Entra Enterprise Passkey: Mobile device logo is missing within the mobile device image on the Passkey naming screen
  - [Passwordless for Windows] Fixed: Entra Enterprise Passkey: System restart prompted to complete HID minidriver FIDO key setup
[Control Center - Integrations] HYPR Enterprise Passkey: FIDO2 Gateway Fallback - 3
- [Control Center - Integrations] Add Observability AT Events
- [Control Center - Integrations] Sync TraceId across Observability Flow
- [Documentation] FIDO2 Gateway articles
- [Mobile App for Android] Add Observability AT Events
- [Mobile App for Android] Add Roaming Capabilities to Enterprise Passkey with Gateway
- [Mobile App for Android] Sync TraceId across Observability Flow
- [Mobile App for Android] Update feature logic for transports
- [Mobile App for Android] Update feature UI for transports
- [Mobile App for iOS] Add Observability AT Events
- [Mobile App for iOS] Add Roaming Capabilities to Enterprise Passkey with Gateway
- [Mobile App for iOS] Sync TraceId across Observability Flow
- [Mobile App for iOS] Update feature logic for transports
- [Mobile App for iOS] Update feature UI for transports
- [Mobile App for iOS] Update FIDO2 Observability Audit Trail Event
- [Passwordless for Windows] Add Observability AT Events
- [Passwordless for Windows] Sync TraceId across Observability Flow
- Bug Fixes:
  - [Mobile App for Android] Fixed: Enterprise Passkey FIDO2 Gateway: Advertise request does not restart on deleting one of the registered Workstation
  - [Mobile App for Android] Fixed: Incorrect traceId in the advertise request on registering second workstation with same rpApp
[Mobile App - Both] Single Registration: Conditional Enrollment
- [Mobile App for Android] Conditional Enrollment: Add enablement and hide the Pending bubble
- [Mobile App for Android] Conditional Enrollment: Parse QR field and send it back to the server
- [Mobile App for iOS] Conditional Enrollment: Add enablement and hide the Pending bubble
- [Mobile App for iOS] Conditional Enrollment: Parse QR field and send it back to the server
[Passwordless for Windows] (PUK) Security Device Unlock Code Support
- [Passwordless for Windows] Create stable serial number for Feitian keys
- [Passwordless for Windows] Implement PUK support (internal bits)
- [Documentation] Security Key PUK support in HYPR Passwordless UI
[Platform - Keycloak] Q3 2024 Authenticator Modules
- [Platform - Keycloak] Allow new Azure integration to use the new Keycloak SAML flow/authenticators

Enhancements

[Adapt; Affirm] Hardening/Beta
[Adapt; Documentation] Add intro in the Signal Handlers page
[Adapt] Control Center Events to consume the PolicyName returned by Risk Engine
[Adapt] Multiple Entities in Policy
[Adapt] Risk Reports: After a 30-minute timeout, the session doesn't get automatically refreshed
[Affirm] Embed Dashboard in Control Center
[Affirm] Make idv-card CSS class expandable and adjustable to screen size, so that it fits its content nicely
[Affirm] Make OnFIDO screen borders look the same as rest of the Affirm Verification Flow
[Affirm] QuickSight Dashboard
[Affirm; API] Add Code Customization API descriptions to Affirm API docs
[All HYPR] Americans with Disabilities Act Fixes
[All HYPR] Remove Dinot font
[All HYPR] Single Registration Multi-Domain Enrollment
[API] API /info calls should not call Redis
[Control Center] Dashboard Enhancements
[Control Center] Firebase SDK: Update UI to allow uploading multiple
[Control Center] Remove legacy Analytics Dashboard (Google React charts) in all environments
[Control Center] User Manager Role access denied to workstations
[Control Center - Integrations] HYPR Enterprise Passkey - Generic Control Center Integration - II
[Documentation] Entra ID Docs: Replace internal domain with something more generic
[Documentation] Firebase Admin SDK setup articles
[Documentation] New/removed Analytics Dashboards
[Documentation] Substitute tiny URLs for embedded UI links to docs; maybe also to external sources
[Documentation] Update Compatibility Matrix article
[Mobile App for Android; Documentation] Fix deprecated links
[Mobile App for Android; Events] WS_AUTH_COMPLETED logging wrong traceID
[Mobile App for Android] Notification icon update
[Mobile App for Android] Single Registration: Allow white label flow
[Mobile App for iOS] FIDO2 Re-Enable WiFi and BLE
[Mobile App for iOS] Remove profiles on Mobile App first launch
[Passwordless - Both] Q3 2024 Passwordless UI improvements
[Passwordless for macOS] Reduce the time occurring between sending Passwordless to the Trash and uninstalling the product
[Passwordless for Windows] Update bundled YubiKey mini-driver to version 4.6.3
[Passwordless for Windows] YubiKey Bio MPE verbiage improvements
[Platform - Database] Startup error after upgrade to 9.1.0
[Platform - Keycloak] Add Vault entry for Keycloak k8s service address to remove NAT GW IPs in allowlist
[Platform - Keycloak] Improve multi-user messaging
[Platform - Keycloak] Perfomance tuning Phase 2
[Platform - Keycloak] Upgrade to 24.0.3
[SDK for FIDO2] Security Audit

Bug Fixes

[Adapt] Fixed: All the evaluation points are not getting invoked in the authentication flow
[Adapt] Fixed: Monitor authentication policy not blocking after FIDO2 failures
[Adapt] Fixed: Upon a cold start of a tenant, Create Policy shows blank page
[Adapt] Fixed: User is not getting blocked when FIDO2 failure threshold is crossed
[Affirm] Fixed: OnFIDO break with retention policy change
[Affirm] Fixed: Photo ID liveness takes a second to load but the buttons render immediately
[Control Center] Fixed: Access Token: When Affirm is not enabled and a user tries to generate an access token with Affirm scope, no user-friendly log message
[Control Center] Fixed: Missing HYPR Logo and color scheme
[Control Center] Fixed: Optimized payload missing Asynchronous Registration in RP App features
[Control Center - Integrations] Fixed: ADFS Plugin: When authentication is denied, no message is shown to user
[Control Center - Integrations] Fixed: Generic OIDC: Correct the reference to BeyondTrust
[Control Center - Integrations] Fixed: Okta: Broken UI Link in Okta Integration
[Control Center - Integrations] Fixed: Okta: Email field is set to "N/A" under user management in advanced mode
[Control Center - Integrations] Fixed: Okta: If two users have the same email, the Enrollment drawer doesn't behave correctly when users clicks 'send email' for either user
[Control Center - Integrations] Fixed: Okta: NullPointerException after generating a Magic Link
[Events] Fixed: EventRequestObject.kt shows incorrect Event labels for Keycloak brute force Events
[Mobile App - Both] Fixed: Single Registration: Workstation-to-web: "Add Linked Workstation" button is longer on iOS than on Android
[Mobile App - Both; API] Fixed: Mobile unable to perform the right action(lock/unlock) as /rp/versioned/device/query/ws/status is returning 302
[Mobile App for Android] Fixed: FIDO2 Gateway Roaming: Delay observed during login to workstation by scanning the QR on credential provider
[Mobile App for Android] Fixed: FIDO2 Gateway: traceID is empty in the mobile gateway request headers
[Mobile App for Android] Fixed: Shortcut to unlock workstation crashes the app
[Mobile App for Android] Fixed: Singe Registration: Web-to-workstation: When we enable TalkBack, we can't manually trigger a push
[Mobile App for Android] Fixed: Single Registration: Web-to-workstation: App is unresponsive when we trigger a push to receive a certificate
[Mobile App for Android] Fixed: Single Registration: Web-to-workstation: When deleting web account, we see text hidden
[Mobile App for iOS; Passwordless for Windows] Fixed: White label in hypr.json and tenant ID for Device Manager link doesn't start Desktop SSO
[Mobile App for iOS] Fixed: Single Registration: Deleting pairings from Device Manager doesn't remove the accounts on the Mobile App
[Mobile App for iOS] Fixed: Single Registration: Workstation-to-web: Clicking "Add Linked Workstation" when the certificate is not ready generates an error
[Mobile App for iOS] Fixed: Single Registration: Workstation-to-web: We see Offline PINs as an option even though successful online unlock wasn't made
[Mobile App for iOS] Fixed: Single Registration: Workstation-to-web: When pairing is deleted from app, we see number of accounts as 1 on list
[Passwordless for Windows] Fixed: Intermittent issue: Enterprise Passkey: Azure Provisioning API: FIDO2 security key creation fails with a fault exception
[Passwordless for Windows] Fixed: QR Fallback application name is cut on Passwordless if tenant name is too long
[Platform - Database] Fixed: Remove "barcode" properties in the document report in the DB
[Platform - Keycloak] Fixed: Keycloak 9.5 fails the Datadog health check

9.3.2 - Patch 2024-08-23

Enhancements

[All HYPR] Remove dinot font
[API] Switch check settings request justVerifySerialNumber to justValidateSerialNumber
[Mobile App for iOS; SDK for iOS] Customer TrustKit
[Passwordless for Windows] Create 9.1.3 and 9.3.2 hotfix releases to pick up YubiKey mini-driver 4.6.3

Bug Fixes

[Platform - Keycloak; Control Center] Fixed: Control Center to Keycloak HttpClient issues

9.3.1 - Patch 2024-08-07

Enhancements

[Control Center] Custom Branding: No flow to delete custom icon
[Control Center - Integrations] HYPR Enterprise Passkey: Entra ID FIDO2 Provisioning APIs - Alpha
[Documentation; Events; Errors] Security Key PUK support Events and Error codes
[Mobile App for Android] Fix timing issue on startup
[Mobile App for Android] Single Registration: Add possibility to add multiple workstations even if one is already present
[Mobile App for Android; Documentation] Fix dead links
[Passwordless for Windows] Incorporate visual indicator that there's a timed process
[Platform - Keycloak] Keycloak is displaying the old favicon; update to current favicon for Mobile App

Bug Fixes

[Affirm] Fixed: Font differences between web and mobile UI
[Affirm] Fixed: OnFIDO breaks with retention policy change
[Control Center - Integrations] Fixed: Remove client secrets from server's response
[Control Center] Fixed: Custom branding boxes should be matched in size for icon and background
[Control Center] Fixed: Sanitize logs for Firebase
[Mobile App for iOS] Fixed: Single Registration: Web-to-workstation: Two computer bubbles appear in iOS after pairing
[Passwordless for Windows; Documentation] Fixed: Link to Entra pairing documentation is broken
[Platform - Keycloak; Control Center] Fixed: Audit Trail: Keycloak Events are not getting generated

9.4.0 - GA 2024-07-24

New Features and Feature Changes

[Adapt; Affirm] Hardening/Beta
- [Affirm] Test out new Affirm redirect for viability
- Bug Fixes:
  - [Affirm] Fixed: Affirm module is not added to HYPR authenticator after upgrade to 9.3
[Adapt; API] Protection for Signals Endpoint
- [API] Add JWKS endpoint support for verifying JWT
- [Adapt; API; Events] Third-party Event ingestion API for Adapt
- [Adapt; API] OAuth credentials: Test button to check if the JWKS endpoint is a valid endpoint
- [Adapt; API] OAuth credentials: Test button to check if the JWKS endpoint is a valid endpoint
- [Control Center; API] Access Token scopes such as Adapt and Affirm should be enabled only if respective features are enabled
- Bug Fixes:
  - [Control Center; API] Fixed: Access Tokens: Affirm endpoints throw 500 Internal server error with non-affirm related tokens
  - [Control Center; API] Fixed: Access Token Scopes: Few Endpoints can be accessed with wrong permissions
  - [Control Center; API] Fixed: Access Tokens: ADAPT_WRITE_POLICY, HYPR_CC_APPLICATIONS token works for ADAPT_TEST_POLICY
[Mobile App for Android] Feature Enablement Performance
- [Control Center] Feature Enablement performance SSL path
- [Mobile App for Android] Update Feature Enablement API call to specify features
- [API] etag not refreshing for settings API call
[SDK for FIDO2] Design, Code
- [SDK for FIDO2] Create centralized repository for source code
[SDK for FIDO2] FIDO2 Javascript SDK II Implementation
- [SDK for FIDO2; Control Center] Update SDK code in Control Center
- [SDK for FIDO2; Platform - Keycloak] Update SDK code in Keycloak
- [SDK for FIDO2] Update SDK code in Sample Web App
- [SDK for FIDO2] Publish to public NPM registry
- [SDK for FIDO2] Set up artifact repository deployment
- [SDK for FIDO2; Documentation] Update Public Documentation

Enhancements

[Adapt] Analytics Dashboards
[Adapt] Custom Policy: Secret values should be redacted from the UI and logs just like Event Handlers
[Adapt] Signal Handlers: Default 'Test action event' JSON improvements
[Affirm ] Control Center Branding and Customization
[All HYPR] Q2 Authenticate Application Security Items
[API] Returning nodeCount instead of result of publish; device/wfa/status doesn't work on cluster
[Control Center] Add Perf Timestamps where missing
[Control Center] Identity Assurance Dashboard Alpha (Prod)
[Control Center] Add IP address to "New device added" email
[Events] Populate Event Tags where they are null for Control Center Events
[Passwordless - Both] Adjust Workstation Unlock to include optional Workstation Signal field
[Passwordless for macOS] Investigate Improving Login Speed
[Passwordless for Windows] Update Enrollment Service to operate in multi-domain forest
[Platform] Allow starting hypr.rp.haasMode without Vault

Bug Fixes

[Adapt] Fixed: Policy assignment for Pre/post-integration Evaluation points 'Adapt Unavailable Fallback' value is not getting saved
[Adapt] Fixed: Policy assignment: 'Adapt unavailable' selected option is not getting saved properly
[Adapt] Fixed: Server is saving duplicate signals with when Send Workstation Signals is enabled
[Adapt] Fixed: When Adapt is enabled, 'Pre HYPR Integration' expects the policy to be assigned, or else Desktop SSO fails
[Adapt] Fixed: Workstation authentication policy assignment 'Adapt Unavailable Fallback' value is not getting saved
[Adapt; Affirm] Fixed: Combined policy 'Affirm Verification Flow ID' description is missing and the default value is - [object Object]
[Affirm] Fixed: OnFIDO break with retention policy change
[All HYPR] Fixed: Single Registration: Web-to-workstation: Deleting user devices from Control Center doesn't delete the pairing from devices
[API] Fixed: DELETE "${SERVER_URL}/cc/api/fido/facet" doesn't return valid JSON response
[Control Center] Fixed: Support Access: Email not wrapping on delete on popup modal
[Control Center; API] Fixed: Firewall: Swagger is getting blocked with 400 error
[Control Center - Integrations] Fixed: Entra ID External Authentication Method PoC
[Control Center - Integrations] Fixed: Google Workspace: Can't add integration
[Passwordless for Windows] Fixed: HyprLibFido2.dll version number isn't being updated
[Passwordless for Windows] Fixed: Link to Entra Pairing documentation is broken

9.3.0 - GA 2024-07-17

New Features and Feature Changes

[Adapt] Implement Adapt for Workstation - Alpha
- [Adapt] Passwordless Signals: Server to handle the client signal sent with 'client/authorize/unlock' request
- Bug Fixes:
  - [Adapt] Fixed: Passwordless Signals: SQL Exceptions are encountered whenever client signals are generated
  - [Adapt] Fixed: Passwordless authentication policy fails even when the client signal has relevant network name
  - [Adapt] Fixed: Consecutive client signals don't make it to Dynamo database
  - [Adapt] Fixed: Workstation authentication PRE_WORKSTATION_UNLOCK evaluation point doesn't get invoked before the FIDO request
  - [Adapt] Fixed: macOS signals are not getting saved in Dynamo database
  - [Adapt] Fixed: Workstation authentication POST_FIDO_AUTH evaluation point failure causes failed unlock
  - [Adapt] Fixed: Workstation authentication PRE_FIDO_AUTH evaluation point is not invoked
  - [Adapt] Fixed: Workstation authentication policy is getting evaluated twice for the POST_WORKSTATION_UNLOCK evaluation point
  - [Adapt] Fixed: Workstation authentication policy does not match the exact network name and allows unlock to pass
[Adapt] Leverage Affirm for re-verification POV1
- [Adapt] Make Adapt + Affirm integration policy as a template
- [Adapt] Policy with template 'Affirm/Adapt Integration' throws error on configuration page
- [Platform - KeyCloak] UX for Adapt + Affirm integration
[Adapt] Q2 Authenticate Signals Updates
- [Passwordless for macOS] Include system and CrowdStrike ID information in device signal
- [Passwordless for macOS] Signals: During unlock flow, send system, network, and location info
- Bug Fixes:
  - [API; Passwordless - Both] Fixed: Client signals are sent after rp/wsapi/client/authorization/complete instead of /rp/wsapi/client/authorize/unlock
  - [Passwordless - Both] Fixed: Network information is of String datatype instead of JSON object
[Adapt] Risk Policy Improvements I - Alpha
- [Adapt] UI/UX Feedback Part 2
- [Adapt] Custom policy page UX feedback Phase 2
- Bug Fixes
  - [Adapt] Fixed: Policy config page: Duplicates: /cc/ui/application and /cc/ui/appconfig/adapt
[Adapt] Risk Policy Visual Reporting Tool
- [Adapt] Risk Reports: Make Event date and timestamp match with the actual timestamp
- [Adapt] Risk Reports: Sort Policy evaluations Events table using eventTimeInUTC column
- [Adapt] Risk Reports: Policy evaluation should match the Audit Trail message
- Bug Fixes:
  - [Adapt] Fixed: Risk Reports: Minor UI issues
  - [Adapt] Fixed: Risk Reports: Tenant data for adaptreleaseint is not available for reports
  - [Adapt] Fixed: Risk Reports: The latest Policy Evaluation Data is not visible in the report; i.e., auto-refresh is not happening
  - [Adapt] Fixed: Risk Reports: Workstation authentication evaluation points are getting classified as Unknown
[Affirm] Control Center Branding and Customization for Affirm
- [Affirm] White labels, logo, and background
- [Affirm] Hide the new UI while we are building it
- [Affirm] Company Identity section
- [Affirm] Logo and Background section
- [Affirm] Backend Logo and Background section
[Affirm] Enhancements
- [Affirm] Ability to add multiple Approvers with progressive logic
- [Affirm] Ability to add multiple Approvers with progressive logic
- [Affirm] Add extension for Send Email; Customization Tab
- [Affirm] Add extension for SMS; Customization Tab
- [Affirm] Add Polyglot JS extension for User Lookup
- [Affirm] Add Polyglot JS extension for User Lookup
- [Affirm] Affirm flow status on cc = disabled, User can still complete affirm flow
- [Affirm] Approver attestation comment modal redesign
- [Affirm] Approver attestation screen redesign
- [Affirm] Approver final approval status screen redesign
- [Affirm] Approver pre-chat summary screen redesign
- [Affirm] Approver summary screen redesign
- [Affirm] Authenticate Approver
- [Affirm] Authenticate Approver configuration changes
- [Affirm] Chat screen redesign
- [Affirm] Enable application screen redesign
- [Affirm] Extension (SMS/Email) backend/API support
- [Affirm] Failure cases not beng handled gracefully by document-upload
- [Affirm] Fix web UI to be more consistent based on an agreed design
- [Affirm] Granular scopes (read and read/write) for CodeCustomizationController
- [Affirm] If reference image exists, skip document upload in Photo ID and Liveness
- [Affirm] Invalid link screen redesign
- [Affirm] Make Activity Log match the steps we have
- [Affirm] New users should be taken to Onboarding flow while existing users should be taken to the index page (current behavior)
- [Affirm] Password reset flow for okta
- [Affirm] Upgrade screen redesign
- [Affirm; Documentation] Affirm Ccontrol Center UI documentation
- [Affirm; Documentation] Affirm Web UI documentation
- [Affirm; Documentation; API] Affirm public API documentation
- Bug Fixes:
  - [Affirm] Fixed: After Approver leaves video call to approve the video remains but is frozen
  - [Affirm] Fixed: Faces do not match redo/retry button does not render correctly
  - [Affirm] Fixed: If Requester is in video before Approver the Approver cannot see the Requester in the video
  - [Affirm] Fixed: Name comparison status not showing results if results is consider
[Affirm] Improvements
- [Affirm] PKCE client secret issue
- [Affirm] Redirect URL can be dynamic in outcome type
- [Affirm] Rename escalateAfterMinutes for Approver field to reduce confusion with new escalate flow
- [Affirm] Update documentation for Okta Password Reset
- Bug Fixes:
  - [Affirm] Fixed: Affirm not pulling phone number from Azure correctly on Approver
  - [Affirm] Fixed: Error message causes button to escape highlighted box
  - [Affirm] Fixed: Three texts and three emails during Affirm flow
  - [Affirm] Fixed: Brute force detection on SMS needs better messaging to user
[All HYPR] Q2 Application Security Items
- [Control Center] Prevent rpUser update
- [API] Restrict user role access
- [Mobile App for iOS] Verify RP's response before attempting registration
[All HYPR] Single Registration: Workstation-to-web re-register/deregister cases
- [All HYPR] Single Registration: Workstation-to-web: User has to delete HYPR Mobile App for iOS during re-registration to see the web account
- [All HYPR] Single Registration: Workstation-to-web: Removal of pairing from Device Manager doesn't reflect on the Mobile App
- [All HYPR] Single Registration: Workstation-to-web: Deletion of user from Control Center doesn't remove pairings from Mobile
- [All HYPR] Single Registration: Workstation-to-web: User has to delete the HYPR Mobile App for Android during re-registration to see the web account
[All HYPR] Single Registration: Web-to-workstation: Deregistration/Re-enroll
- [All HYPR] Single Registration: Deregistration of one pairing should remove all associated pairing entries
- [Mobile App for iOS] Implement Single Registration on iOS Mobile app
- [Mobile App for Android] Single Registration: Web-to-workstation: Remove VDI when deregistering a workstation, to remove certificate from device
- Bug Fixes:
  - [All HYPR] Single Registration: Web-to-workstation: Deletion of web account doesn't always delete corresponding computer bubble on iOS
[API] (PUK) Security device unlock code support
- [Control Center] Server side for PIN PUK support
[Control Center] FIDO2: FacetID Management, Validation, Compatibility
- [Mobile App for iOS] Existing registrations cannot authenticate if FIDO Allowlist Facets is enabled afterward
- [Mobile App for Android] Existing registrations cannot authenticate if FIDO Allowlist Facets is enabled afterward
[Control Center] Fingerprint JS hosted
- [Control Center] Host Fingerprinting JS script
- [Passwordless - Both] Pass traceId into Desktop SSO link for Passwordless
- Bug Fixes:
  - [Control Center] Fixed: Two traceIds are created for authentication
[Control Center - Integrations] HYPR Enterprise Passkey: FIDO2 Gateway Fallback - 2
- [Control Center - Integrations] Backend: Expose BLE and WiFi transport options for Enterprise Passkey configuration
- [Control Center - Integrations] UX: Expose BLE and WiFi transport options for Enterprise Passkey configuration
[Control Center - Integrations; API] HYPR Enterprise Passkey: Entra ID FIDO2 Provisioning APIs - Alpha
- [Control Center - Integrations; API] Entra Provisioning API toggle in Control Center
- [Control Center - Integrations; API] Entra: Create the Provisioning API
- [Control Center - Integrations; API] Entra: Create endpoint for the Provisioning API
[Control Center - Integrations; Mobile App for Android] HYPR Enterprise Passkey: FIDO2 Gateway Fallback - Beta
- [Control Center] FIDO2 Gateway Advertise is False in background
- [Control Center - Integrations] Azure: Domain-joined environment: Delete workstation and then credential, and the user stays in paired with Azure
- [Passwordless for Windows] FIDO2 Gateway CTAP error responses are not being relayed to the USB HID driver
- [Mobile App for Android] Error information overlay displays on tapping over the successful authentication entries in login history screen
- [Mobile App for Android] Enterprise Passkey: Unable to unlock workstation using passkey if app is backgrounded on receiving the User Presence prompt
- [Mobile App for Android] Enterprise passkey: Error not displayed on completing authentication on the Mobile App that was resumed from background which had the User Presence prompt
- [Mobile App for Android] FIDO2 Gateway: When the workstation is unreachable, Android sends two advertise requests within 4s, repeating every 30s
- [Mobile App for Android] Login History screen displays more than 50 entries
[Control Center] Customer Tenant Access Approval/Support Access Bug Fixes
- [Control Center] Fixed: Support Access:Able to save on no action example custom date you can switch to custom date and save no change but save action is shown
- [Control Center] Fixed: Support Access:Date picker while flipping month causes 1st of month to be selected on future months/current month selects today's date
- [Control Center] Fixed: Support Access: Canceling swap of custom date vs. always access shows saved state banner
- [Control Center] Fixed: Support Access: Email list no wrapping on screen causes scroll bar
- [Control Center] Fixed: Support Access: Audit Trail not showing correct numbers showing 1-5 instead of the number of entries
- [Control Center] Fixed: Support Access: Audit Trail does not refresh on toggle off/on
[Passwordless for Windows] Q3 2024 Security Device Enhancements
- [Passwordless for Windows] Update bundled YubiKey mini-driver to version 4.6.1
- Bug Fixes:
  - [Passwordless for Windows] Fixed: "YubiKey PUK Lock Enabled" feature is broken
  - [Passwordless for Windows] Fixed: Cannot log in with YubiKey Bio if Security Key PIN Minimum Length is set to 7 and current PIN is 7 on Windows 11
  - [Passwordless for Windows] Fixed: Fingerprint registration UI failed to appear resulting in error during YubiKey Bio MPE pairing, though registration was successful

Enhancements

[Adapt] Add new Workstation Unlock Evaluation Points
[Adapt] Add Polyglot JS User Lookup extension Test tab
[Adapt] Datadog logs flooding due to Event Handler-generated Events parsing issue
[Adapt] Event Handlers Alpha
[Adapt] Monitoring and alerting
[Adapt; Control Center - Integrations] Adapt is breaking the Okta integration
[Adapt; Documentation] Create and document a beginner policy
[Affirm] Enable sonar on Affirm code
[API] Returning nodeCount instead of result of publish; device/wfa/status doesn't work on cluster
[API] Take advantage of justVerifySerialNumber in checksettings payload
[Control Center] Asynchronous Registration: Push consent shouldn't be mandatory during registration
[Control Center] FIDO2/Login Settings
[Control Center] Finally removed the apostrophe/comma in the New Application dialogs
[Control Center] Server is not picking the proxy from the environment variable
[Control Center - Integrations] ADFS deeplinks issues
[Control Center - Integrations] Create maintenance job to add aliases to Okta Integration users
[Control Center - Integrations] Sanitize logs
[Control Center; Documentation] Update Control Center links to new Documentation portal
[Documentation] Entra ID Documents: Replace internal domain with something more generic
[Documentation] Generic OIDC articles
[Documentation] OAuth token usage
[Documentation; API] MDS API endpoints Part I
[Documentation; API] Security Key PUK support APIs
[Documentation; Errors] Error Code Cleanup
[Events] QR Authentication timeout, QR Authnentication scan are not generating Events
[HYPR Mobile App - Both] QR Authentication skip confirmation prompt
[Mobile App for Android] Android appeal in the Play Store
[Mobile App for iOS; SDK for iOS] Automation: Request to add ID for Transaction Amount and Text displayed
[Mobile App for iOS] Enterprise Passkey: Fix advertise called during FaceID
[Mobile App for iOS] Improve HYPR Mobile App speed
[Mobile App for iOS] Request for element Locator in error message screen
[Passwordless for Windows] Log every file submitted to DigiCert code signing service
[Passwordless for Windows] Optimize code signing during CI/CD builds
[Passwordless for Windows] Update ATR's for Feitian security keys
[Passwordless for Windows] Use same names for Feitian keys that Passwordless 8.X used
[Platform] Fix 404 Page
[Platform - Database; Events] Add Primary Key Index to idv_audit_event table
[Platform - Firebase] Firebase SDK: Multiple projects with OAuth config
[Platform - Keycloak] Custom migration for existing tenant to move Ping DaVinci and BeyondTrust integrations to use the new Keycloak OIDC flow/authenticators
[Platform - Keycloak] Match Keycloak UI to Control Center UI so the login options are the same
[Platform - Keycloak] Remove misleading brute force logs when error occurs

Bug Fixes

[Adapt] Fixed: HYPRSpeed is missing in Login limits template
[Adapt] Fixed: Policy management Event Search Window issues
[Adapt] Fixed: Push attack prevention policy: QR code is not getting displayed; i.e., Mobile option is going away and FIDO2 is displayed
[Adapt] Fixed: User forced to click "Configure Policy" after creating policy
[Affirm] Fixed: ApproverRequestResultsAction: Get reference image from the database, not only from the cache
[API] Fixed: Magic link call /cc/ui/rpUser/self is intermittently returning 404
[Control Center] Fixed: Device Manager template capturing
[Control Center] Fixed: QR Fallback: Control Center users cannot use QR Fallback to login
[Control Center] Fixed: SVG Display in UI management screen
[Control Center] Fixed: User Management page has extra padding above the 'Web Domains' table
[Control Center - Integrations] Fixed: Enrollment drawer doesn't show two users with same primary email address
[Control Center - Integrations; API] Fixed: Okta: On launching Device Manager from the Okta dashboard, 404 errors occur with the /cc/ui/rpUser/self endpoint
[Control Center; API] Fixed: Server expecting machineId populated in Audit API for FIDO-Only registration/authentication flows
[Control Center; Documentation] Fixed: Links to new Documentation portal
[Mobile App for Android] Fixed: All workstation registrations are being removed on de-registering one workstation pairing
[Mobile App for Android] Fixed: Single Registration: Workstation-to-web: Removal of pairing from Device Manager doesn't reflect on Mobile App
[Mobile App for iOS] Fixed: Device cannot authenticate if FIDO Allowlist Facets is enabled before registration
[Mobile App for iOS] Fixed: Single Registration: Workstation-to-web: Deletion of Computer Bubble doesn't delete Web Account
[Passwordless for macOS] Fixed: Signal reporting can answer with code 204
[Passwordless for macOS] Fixed: Single Registration: Web-to-workstation: Web account's Computer Bubble keeps getting hidden
[Passwordless for macOS] Fixed: Uninstalling client doesn't restore default unlock screen
[Passwordless for macOS; Mobile App for Android] Fixed: Single Registration: Web-to-workstation: All accounts on Android are deleted when user in web rpapp gets deleted on Control Center
[Passwordless for Windows] Fixed: CSR generation times out during IDEMIA smart card registration
[Passwordless for Windows] Fixed: WiFi and BLE icons on the "Choose Connection" screen are clipped
[Platform - Database] Fixed: rp_user_alias table not cleaned up after delete
[Platform - Keycloak] Fixed: Authentication failing with error 'Unexpected error when handling authentication request to identity provider'

8.7.2 - Patch 2024-06-13

Enhancements

[API] Implement token refresh retry on settings endpoint

8.4.2 - Patch 2024-06-13

Enhancements

[Mobile App for Android; SDK for Android] Android support in 8.4.2

9.1.2 - Patch 2024-05-29

New Features and Feature Changes

[Passwordless for Windows] Q3 2024 Security Device Enhancements
- [Passwordless for Windows] Implement UI for FIDO2 fingerprint management
- [Passwordless for Windows] Update bundled YubiKey mini-driver to version 4.6.1
- Bugs Fixed:
  - [Passwordless for Windows] "YubiKey PUK Lock Enabled" feature is broken

Enhancements

[All HYPR] Americans with Disabilities Act (ADA) Fixes Pass 4
[API] Returning nodeCount instead of result of publish using device/wfa/status doesn't work on a cluster
[Control Center] FacetID Management, Validation, Compatibility
[Control Center] FacetID UI Accessibility Changes
[Control Center - Integrations] Okta Extension: Customer use case
[Control Center - Integrations] Okta Extension: Issues with customer upgrade
[Control Center - Integrations] Okta Extension: Use oktapreview when looking for client
[Mobile App for Android] Customer permission issue
[Passwordless for Windows] Successful pairing screen timeout
[Passwordless for Windows] Update ATR's for Feitian security keys
[Passwordless for Windows] Use same names for Feitian keys that Passwordless 8.X used

Bug Fixes

[Affirm] Fixed: Mobile IdV flow shows blank spinning screen after selecting document type to upload
[Control Center - Integrations] Fixed: Multiple problems with security key removal dialog
[Control Center - Integrations] Fixed: Security Key removal does not pop up in 9.1+
[Control Center] Fixed: Errors thrown with creation and deletion of duplicate facetIDs (UI)
[Mobile App for Android; SDK for Android] Fixed: App crash for Location permission with Signals enabled

9.1.1 - Patch 2024-05-01

New Features and Feature Changes

[Affirm] Enhancements
- [Affirm] Rename AFFIRM Event field 'costsTracking | isSuccessful' to enable efficient parsing
- [Affirm] Email Case Sensitivity
- [Affirm] Document-upload not handling failure cases gracefully
- [Affirm] When the IdV flow is Disabled, the Requester can still complete the Affirm flow
[Control Center] FIDO2: FacetID Management, Validation, Compatibility
- [Control Center] FIDO2: Add 'Delete' button for trusted facets
- [Mobile App for iOS] Existing registrations cannot authenticate if FIDO Allowlisted Facets is enabled afterward
- [Mobile App for Android] Existing registrations cannot authenticate if FIDO Allowlisted Facets is enabled afterward

Enhancements

[Adapt] Workstation authentication policy UI changes
[Adapt; Control Center - Integrations] Adapt is breaking the Okta Integration
[All HYPR] 'Azure' still appears in several places in the dialog options; change to 'Entra' or 'Microsoft Entra ID'
[All HYPR] Single Registration (Both) chsch sso issue
[API] Take advantage of justVerifySerialNumber in checksettings payload
[Mobile App for iOS] Enterprise Passkey: Fix advertise called during FaceID
[Mobile App for iOS] FIDO2 Disable WiFi and BLE
[Passwordless for Windows] Add support for YubiKey 5.7.0 firmware
[Passwordless for Windows] Allow security key registration to set alphanumeric PINs
[Platform - Keycloak] Bring jQuery changes to the Keycloak registrator

Bug Fixes

[Adapt] Fixed: Using the new Login Limits policy template, the user is getting blocked before the 'number of failed events' condition is met
[Control Center] Fixed: Device Manager registration fails on Safari browser
[Control Center - Integrations] Fixed: Azure domain-joined: Delete credential and then workstation; uer stays in "Paired with HYPR' in the Azure portal
[Control Center - Integrations] Fixed: User Management: Pending tab message still uses 'WFA' and should use 'Passwordless'
[Mobile App for Android] Fixed: Enterprise Passkey: On deregistering the linked security key for a hybrid account, the Workstation pairing is also being removed
[Mobile App for Android] Fixed: Passwordless Unlock: Location flickers and Unlock fails

9.2.0 - GA 2024-04-11

New Features and Feature Changes

[Adapt] Data retention Events TTL
- [Adapt] Set retention TTL to 5 years
[Adapt] Risk Policy Improvements I Alpha
- [Adapt] Fetch individual policy when rendering policy configuration
- [Adapt] Home page; Create Policy flow; built-in policy pages UX feedback
- [Adapt] Custom policy pages UX feedback
[Adapt; API] Protection for signal endpoint
- [Adapt; API] API security for the signal service
- [Adapt; Control Center; API] UI updates for OAuth API tokens
- [Control Center; API] OAuth API token: Token not getting created when OIDC related permissions are selected
- [Control Center; API] OAuth credentials: Creating a token with 999999s TTL throws error
- [Control Center; API] OAuth Credentials: Token TTL is not correctly reflected in the UI
- [Control Center; API] OAuth Credentials: Able to create a token with blank 'Use JWKS endpoint'
[Affirm] Enhancements
- [Affirm] Front end validations around redirect URL
- [Affirm] Update copy for Photo ID and Liveness
- [Affirm] Warning message cleanup UI for invalid configurations
- [Affirm] Public API - Design
- [Affirm] Activity Log Name Check field implementation
- [Affirm] Improve look of the email step
- [Affirm] Improve look of the phone step
- [Affirm] Improve look of the location step
- [Affirm] Improve look of the start step
- [Affirm] Improve look of the final wrapping up step for Requester
- Bug Fixes:
  - [Affirm] Fixed: Approver does not receives phone message with Requester detail and link to approve
  - [Affirm] Fixed: 500 on Approver clicking continue in Approver chat
  - [Affirm] Fixed: Phone number match not throwing error unless comparing last 3 digits
  - [Affirm] Fixed: Upon clicking Redo, "you'll" switches to "you'll"
  - [Affirm] Fixed: Camera is enabled but microphone is not causing extra click for user
  - [Affirm] Fixed: Background shifts when entering OnFIDO part of the flow
  - [Affirm] Fixed: Button sizes and style to match previous steps in Affirm flow
  - [Affirm] Fixed: Error message . vs . on Affirm email page
  - [Affirm] Fixed: Chat of Approver and Requester appears are different
  - [Affirm] Fixed: 500 on going directly to URL
  - [Affirm] Fixed: UI is not reactive to screen size
  - [Affirm] Fixed: Background of application connection default new login method does not cover the entire name for the drop-down
  - [Affirm] Fixed: Session timeout on cc/ui/idv leads to 'Access Denied' on refresh; when 'Log In' is clicked again opens a Control Center login instead of an Affirm landing page
[Control Center] Audit Trail Enhancement
- [Control Center] Audit Trail: Updating machineid, eventtags and deviceType validation and adding new TC in validation
[Control Center] Technical Debt
- [Control Center] Dropdown’s option is not visible on mouse-hover
- [Control Center] Audit trail selected date doesn't get displayed
- [Control Center] DEV env CSRF token fix
- [Control Center] React Google chart using deprecated version
[Control Center - Integrations] Generic OIDC Integration
- [Control Center - Integrations] Generic OIDC: Feature enablement
- [Control Center - Integrations] Generic OIDC: Create tile and Beta UI
- [Control Center - Integrations] Generic OIDC: Implement Integration
- [Passwordless for Windows] Uninstall doesn't deregister paired devices
[Control Center - Integrations] HYPR Enterprise Passkey: FIDO2 Gateway Fallback Part 2 - Beta
- [Passwordless for Windows] Client should reflect correct Enterprise Passkey status when brought into focus
- [Control Center] Custom Device Manager templates to aid customer migrations
[Mobile App - Both] Single Registration: Web-to-workstation Deregistration/Re-enroll Bug Fixes
- [Mobile App for Android] Fixed: Single Registration: Web-to-workstation: Displays bubble with the computer icon instead of a QR code after obtaining certificate
- [Mobile App for iOS] Fixed: Workstation bubble naming has machine name instead of username
[Passwordless for Windows] Missing removed registrations
- [Passwordless for Windows] Uninstalling the client doesn't deregister paired security keys
[Platform - Keycloak; Events; SDK - All] Keycloak Observability
- [Platform - Keycloak; Events] Propagate Keycloak Events to Control Center
- [Platform - Keycloak; Events] Enable Keycloak login Event for new integrations
- [Platform - Keycloak; Events] Send Keycloak modules login Events to Control Center
- [Platform - Keycloak; Events] Send Keycloak authentication/registration login Events to Control Center
- [Platform - Keycloak; Events] Tracing and Event improvements - traceId
- [Platform - Keycloak; Control Center - Integrations; Events] Create a custom migration to enable Keycloak login Events for all integrations
- [Platform - Keycloak; Events] Sending Events from Keycloak throws exceptions
- [SDK - All] SDK method to log successful Events
- [SDK for Java] Make sure all Java SDK calls use the traceId from the session

Enhancements

[All HYPR] CVE-2023-52428
[All HYPR] CVE-2024-22259(8.100000381469727)
[All HYPR] Single Registration (Both) chsch sso issue
[Control Center - Integrations] ADFS Plugin v2: Replace external IIS Web Server needed for the HYPR ADFS Plugin to a URL served via ADFS
[Control Center - Integrations] Entra ID: Create enablement for the APIs
[Control Center - Integrations] Extension web hooks
[Control Center; Adapt] Remove Login Limits local template from Control Center, point strictly to PolicyTemplates Risk Engine API in code
[Control Center] Add POV banner
[Control Center] ccdocs target is failing
[Control Center] Drop zipkin reporting
[Control Center] Update .jar dependencies
[Passwordless for macOS] Don't use System Events to start HYPR after the first reboot
[Passwordless for Windows] Add support for YubiKey 5.7.0 firmware
[Passwordless for Windows] Allow security key registration to set alphanumeric PINs
[Passwordless for Windows] Force Windows to refresh icons after client installation
[Passwordless for Windows] Update bundled YubiKey mini-driver to version 4.6.0
[Platform - Keycloak] Create SAML integration APIs
[Platform - Keycloak] Custom migration for existing tenant to move Okta integration to use the new Keycloak OIDC flow/authenticators
[Platform] Upgrade owasp-dependency
[Platform] Upgrade Spring to 3.2

Bug Fixes

[Adapt] Fixed: Assign policy returns 200 with invalid policy ID and invalid rpApp
[Adapt] Fixed: Keycloak authentication defaulting to Push when both Mobile App and FIDO2 are registered
[Adapt] Fixed: Signals do not report local network information
[Affirm] Fixed: UI import issues
[Control Center] Fixed: Single Registratio: Workstation-to-web: No email associated with user doesn't create a web account with UPN
[Mobile App -Both] Fixed: Authentication message differs on Android and iOS
[Mobile App for Android] Fixed: Single Registration: Workstation-to-web: Hide the "Add Linked Workstation" button
[Mobile App for iOS] Fixed: Signals have duplicate values in many attributes
[Passwordless for macOS] Fixed: Ensure TokenDriver is available for the current user when the workstation is locked
[Passwordless for macOS] Fixed: Server crashes trying to read user info
[Passwordless for macOS] Fixed: Shows Android icon instead of iPhone icon when paired
[Platform - Keycloak] Fixed: QR authentication synchronous form submission blocks UI Automation

9.1.0 - GA 2024-04-10

New Features and Feature Changes

[Adapt] Event Handlers Alpha
- [Adapt] Event Handlers: Context functions
- [Adapt] Event Handlers: Rename: Front end
[Adapt] Risk Policy: Custom Code Configuration w/Dynamic UI [Beta]
- [Adapt] Add AI assist button
- [Adapt] Further separate built-in and custom policies
- [Adapt] Provide more context for versioning
- [Adapt] Relocate documentation
- [Adapt] Custom policies UI
- [Adapt; API] Custom policies CRUD API
[Adapt] Risk Policy Improvements I Alpha
- [Adapt] Risk Engine: Pass Events into Event attribute for test evaluations
- Bug Fixes:
  - [Adapt] Custom policy UI: 'My policy template' policy evaluation throws exception
[Adapt] Risk Policy: Visual Reporting Tool
- [Adapt] Policy evaluation results report
- [Adapt] Risk Report Highlights
[Affirm] Bug Fixes
- [Affirm] Control Center Activity Log page selector is not selectable and is blocked by the artifacts being populated in the table
- [Affirm] If all settings are off you get the basic error on IDV page
- [Affirm] No verification flow default selected if no application is set up for Affirm
[Affirm] Enhancements
- [Affirm] Make Document photo and video selfie step more user friendly (reference IdV steps)
- [Affirm; API] Public API Implementation
- Bug Fixes:
  - [Affirm] Configuration error TAP is allowed for Okta
  - [Affirm] Name check in Activity Log showing CLEAR even when not used in the flow
[Affirm] GA
- [Affirm] Add Affirm entry point on Keycloak authenticator
- [Affirm] Add Affirm entry point on Keycloak Modules
- [Affirm] Allow for auto-credentialing (no manager approval)
- [Affirm] BE add name extraction and cross-referencing with IdP
- [Affirm] BE Support for username as an initial identifier
- [Affirm] BE Support more flexible configuration options
- [Affirm] Control Center add name extraction and cross-referencing with IdP
- [Affirm] Control Center Allow for auto-credentialing (no manager approval)
- [Affirm] Control Center Support for username as an initial identifier
- [Affirm] Control Center Support more flexible configuration options
- [Affirm] IdV Support for username as an initial identifier
- [Affirm] Activity Log: Document Verification result field implementation
- [Affirm] Activity Log: Image File Name field implementation
- [Affirm] Activity Log: Reduce amount of queries for fetching Activity Log details
- [Affirm] Activity Log: Registration field implementation
- [Affirm] Add document load step to the Twilio flow; remove it from the chat window
- [Affirm] Add facial rekognition and SMS permissions to tenant IAM user
- [Affirm] Add new item to generated chat for continue for Requester chat
- [Affirm] Add picture taken step to the Twilio flow; remove it from the chat window
- [Affirm] Attacker can brute force phone number without any limitation at all
- [Affirm] Base settings/modified settings in Control Center front end HYPR Affirm component; refactor/consolidate so that there are fewer duplications in both default/modified settings representative objects
- [Affirm] Control Center UI changes to match the public API
- [Affirm] Check that Azure Users are active in data source before continuing Affirm flow
- [Affirm] Clean the Twilio chat step
- [Affirm] Create a simple error page for errors
- [Affirm] Face ID verification can be bypassed using any random blurry image
- [Affirm] Finish the implementation for Approver assignment
- [Affirm] Go over copy on the following messages
- [Affirm] Simplify Affirm Events
- [Affirm; Control Center - Integrations] Okta: Check that User is active in Data Source before continuing Affirm flow
- [Documentation] Technical Edits for HYPR Affirm
- [All HYPR] CVE-2023-26159
- Bug Fixes:
  - [Affirm] Fixed: 500 error after multiple SMS requests
  - [Affirm] Fixed: 500 error on Requester side if no Approver action is found
  - [Affirm] Fixed: 500 on Approver flow
  - [Affirm] Fixed: Activity Log details page shows recovery correctly while the index page shows it as onboarding
  - [Affirm] Fixed: Activity Log more details showing passport as document type but driver's license was used
  - [Affirm] Fixed: Misleading error message appears when Requester's Mobile Number is not added in IDP
  - [Affirm] Fixed: Attestation toggle needs to work with the current flow
  - [Affirm] Fixed: Auto approval not showing as approved and instead showing N/A
  - [Affirm] Fixed: Back button here leads to an error state remove
  - [Affirm] Fixed: Back button on video chat leads to a confirm form resubmission page
  - [Affirm] Fixed: Clean up current state of Affirm if it is turned off
  - [Affirm] Fixed: Duplicate entries on approval in Activity Log
  - [Affirm] Fixed: Duplicate entry on rejection in Activity Log
  - [Affirm] Fixed: Global toggle not showing model for Affirm enablement off
  - [Affirm] Fixed: Going to IDV page while disabled leads to 500
  - [Affirm] Fixed: HYPR auto Approver/Approver is blank
  - [Affirm] Fixed: If Approver approves Requester before they complete the chat verification the Requester cannot continue
  - [Affirm] Fixed: If session expires when you return to the page you get a 500
  - [Affirm] Fixed: If user does not have the country code for mobile phone in their IDP you fail the phone number check
  - [Affirm] Fixed: If you click the link on the email after you activate the link on your phone you get a 500
  - [Affirm] Fixed: Images failing to send on the front end after upload by Requester
  - [Affirm] Fixed: IP address in Activity Log PII
  - [Affirm] Fixed: More PII in the Datadog logs
  - [Affirm] Fixed: On second pass the geo location fails
  - [Affirm] Fixed: On second pass the user needs to select new phone or lost device and enter email twice
  - [Affirm] Fixed: OnFIDO Document Verification X button not returning to correct location
  - [Affirm] Fixed: Remove the upgrade model while the FF is off
  - [Affirm] Fixed: Requestor vs Requester in UI
  - [Affirm] Fixed: Second Approver link sent in same session redirects to main Affirm page
  - [Affirm] Fixed: Someone else Approver sending emails to Okta email address for manager
  - [Affirm] Fixed: Update copy on email for verification request
  - [Affirm] Fixed: Upgrade now link on banner does nothing
  - [Affirm] Fixed: Video doesn't display chat as expected
  - [Affirm] Fixed: When integration is deleted Affirm does not get cleaned up
[All HYPR] Enterprise Passkey: FIDO2 Gateway Fallback Bug Fixes
- [Mobile App - Both] Fixed: Enterprise Passkey: FIDO2 Gateway: Authentication does not fallback to FIDO2 Gateway transport when BLE is disabled on the Mobile device
- [Mobile App - Both] Fixed: Enterprise Passkey: FIDO2 Gateway transport is not available on enabling the feature on Control Center after a Control Center upgrade
- [Passwordless for Windows] Fixed: FIDO2 Gateway: Unable to register Enterprise Passkey using FIDO2 Gateway on Windows 11
[All HYPR] Single Registration: Workstation-to-web: rpApp model Alpha
- [Mobile App for iOS] Implementation
- [Passwordless - Both] Single Registration: Workstation-to-web: Certificate issue: chsh case
- [Passwordless - Both] Single Registration: Workstation-to-web: Multiple rpAppId
[Control Center - Extensions] Security Key pre-registration hook [Part II]
- [Passwordless for Windows] Passwordless Security Key pre-registration hook before certificate is requested
[Control Center - Integrations] HYPR Enterprise Passkey - FIDO2 Gateway Fallback - 1
- [Control Center - Integrations] FIDO2 Gateway PoC
- [Mobile App for Android] FIDO2 Gateway Implementation
- [Mobile App for Android] fido2gateway moving /advertise to longpool
- [Mobile App for iOS] fido2gateway moving /advertise to longpool
- [Passwordless for Windows] FIDO2 Gateway Implementation
- Bug Fixes:
  - [Mobile App for Android] Fixed: Wrong machineUserName on Azure FIDO2 Pairing Events (FIDO2_DEVICE_REG + FIDO2_DEVICE_REG_COMPLETE)
[Control Center - Integrations] HYPR Enterprise Passkey - Generic Control Center Integration
- [Control Center - Integrations; API] Add Enterprise Passkey data to the mobile endpoint
- [Control Center - Integrations; API] Add new API for Enterprise Passkey settings
- [Control Center - Integrations] Add Enterprise Passkey settings to Advanced / FIDO2 Settings tab
- [Control Center - Integrations] Add Enterprise Passkey settings to Standard Integration / Login Settings tab
- [Control Center - Integrations] Add Enterprise Passkey settings to Standard Workstation / Workstation Settings tab
- [Control Center - Integrations] Add username to rp_enrolled_credentials_data primary key
- [Control Center - Integrations] Change setup of Azure Native integration to use Generic Enterprise Passkey settings
- [Control Center - Integrations] Create FF FIDO2_GATEWAY
- [Control Center - Integrations] Enable FIDO2_DEVICE_REG_COMPLETE and FIDO2_DEVICE_DEREG logic for generic
- [Control Center - Integrations] Generic Enterprise Passkey: Add recovery PIN option to device details
- [Control Center - Integrations] Generic Enterprise Passkey: Use Generic User Management component in V1 user management
- [Control Center - Integrations] Generic Enterprise Passkey: Use Generic User Management component in Workstation user management
- [Control Center - Integrations] Migrate Azure Native restricted domains to Generic Enterprise Passkey settings
- Bug Fixes:
  - [Control Center - Integrations] After re-pairing workstation, user is present in two groups in Azure portal
  - [Control Center - Integrations] Generic Enterprise Passkey: Performing FIDO2 pairing with Ping Adapter overwrites the email in User Management
  - [Control Center - Integrations] User information not fully removed from Keycloak after user deletion
[Control Center - Integrations] Logo / Brand Updates
- [Control Center] Device Manager 2.0: Icon changes for 9.1
[Control Center - Integrations] Update All Branding
- [Control Center - Integrations] ADFS Plugin: HYPR Branding Implementation
- [Mobile App for Android] HYPR Brand Implementation (HYPR, SDK, Reference, FCA, Maven, Play Store)
- [Mobile App for iOS] HYPR Brand Implementation (HYPR, SDK, Reference, FCA, Swift Package, App Store)
- [Passwordless for macOS] HYPR Brand Implementation
- [Passwordless for Windows] HYPR Branding Update
[Documentation] New Documentation Portal
- [Documentation] Doc site external deploy - 9.1
[Events] Improve external authentication Event tracking
- [Events; Passwordless for macOS] Log macOS login with TouchID as an EXTERNAL_AUTH_COMPLETE Event
- [Passwordless for Windows] Generate EXTERNAL_AUTH_COMPLETE even if user has no paired devices
[Mobile App - Both] Q1 2024 Mobile App Tech Debt
- [Mobile App for Android] Stop support for FCA, Dev App, and All ADP
- [Mobile App for iOS] Create List of Device IDs for Apple Developer Program
- [Mobile App for iOS] Deprecate ADP TaADP
- [Mobile App for iOS] Deprecate HYPR Firebase Notification Adapter
- [Mobile App for iOS] Remove Dev version of HyprApp
- [Mobile App for iOS] Stop Support for FCA and all ADP
[Mobile App - Both] QR Scanning Widget
- [Mobile App for Android] QR to unlock Widget
- [Mobile App for iOS] QR to unlock Widget
[Passwordless for Windows] Basic Branding Customization for Windows
- [Passwordless for Windows] Apply customized branding during Passwordless upgrades
- [Passwordless for Windows] Basic Branding Customization
- Bug Fixes:
  - [Passwordless for Windows] Preserve "old style" UI customizations
[Passwordless for Windows] Q3 2024 UI improvements
- [Passwordless for Windows] Enter key should "click" the primary button
- [Passwordless for Windows] Force Windows to refresh icons after Passwordless installation
- [Passwordless for Windows] Make sure an appropriate control has focus
[Passwordless for Windows] Support for YubiKey Bio MPE Security Keys (Inline Fingerprint Registration)
- [Passwordless for Windows] FIDO2 fingerprint registration during PIV pairing
- [Passwordless for Windows] Copy text fingerprint enrollment messages
- [Passwordless for Windows] Extend SMARTKEY_AUTH_COMPLETE Audit Trail Event to indicate PIN or Fingerprint
- [Passwordless for Windows] Implement code to enroll fingerprints on YubiKey BIO MPE [1/2]
- [Passwordless for Windows] Implement code to enroll fingerprints on YubiKey BIO MPE [2/2]
- [Passwordless for Windows] Implement UI for FIDO2 fingerprint registration during PIV pairing [1/2]
- [Passwordless for Windows] Remove timeout during start of fingerprint enrollment process
- [Passwordless for Windows] Update bundled YubiKey mini-driver to version 4.5.3
- [Passwordless for Windows] Update bundled YubiKey mini-driver to version 4.6.0
- [Passwordless for Windows] Update post registration message for YubiKey Bio MPE devices
[Platform - Certificates] Certificate Services (Certificates Tracking)
- [Platform - Certificates; API] Make certificate information available for Bulk Export
- [Platform - Certificates] Add certificate serial numbers and expiration to device logs
[Platform - Keycloak] Authenticator Refactoring Phase 2
- [Platform - Keycloak] Bring Azure module to be up-to-date
- [Platform - Keycloak] Generalize Adapt code so we can use it in the new modules
- [Platform - Keycloak] 9.1 Upgrade to the latest Keycloak server

Enhancements

[Adapt; Control Center - Integrations] Adapt is breaking the Okta integration
[Adapt; Mobile App for Android] Remove the separate signal request during authentication as the signal payload is already sent with fido/get
[Adapt] Build out extension logic for workstation evaluation points
[Adapt] Create a workstation policy for network names (DEMO); Beta
[Adapt] Policy: Invoke Adapt for policy evaluation during workstation authentication
[Adapt] Risk engine should search the Events based on the policy and not hardcode to 7L
[Adapt] Risk Policy: Action Events
[Affirm] Make BasicApproverInfo and BasicManagerInfo one structure
[All HYPR] Americans with Disabilities Act (ADA) Fixes Pass 3
[All HYPR] Single Registration: Workstation-to-web: Multiple rpAppId setup; fix logging into ws
[All HYPR] Single Registration: setup
[Control Center] Add forwarding functionality for the IP allowlist
[Control Center] Custom Device manager templates/updates for customer
[Control Center] Enable facetid checking for FIDO UAF; add ability to delete facet IDs
[Control Center] Pass Time Filters into Audit Trail Requests in UI
[Control Center] Remove login option change UI
[Control Center] Switch background-image to background-gradient
[Control Center - Extensions] Add extension webhooks
[Control Center - Extensions] Add service account restiction
[Control Center - Extensions; API] Incorporate extension calls inside workstation Unlock APIs
[Control Center - Integrations] Okta: UPN in Integrations
[Documentation] Documentation modifications for breaking upgrades
[Documentation] Entra ID Documentation: Replace internal domain with something more generic
[Mobile App for Android] Remove Sensory
[Mobile App for Android] Update UI/color when possible
[Mobile App for iOS] Implement SDK Deprecations in consuming apps
[Mobile App for iOS] Provide custom iOS build
[Mobile App for iOS] Remove Sensory
[Mobile App for iOS] Update App privacy info manifest
[Mobile App for iOS] Update UI/color when possible
[Mobile App for iOS] Wording changes to accommodate Azure -> Entra
[Passwordless - Both] Remove pinned shortcut after uninstallation
[Passwordless for macOS] Implement workaround for Sonoma screensaver
[Passwordless for macOS] Packaging for Intune deployment
[Passwordless for macOS] Replace fa-devices.js with devices.js and remove login options prompt
[Passwordless for Windows] Advanced Branding Customization
[Passwordless for Windows] IDEMIA PIV/FIDO2 Badge Support
[Passwordless for Windows] Provide Passwordless build without obfuscation
[Passwordless for Windows] Support for YubiKey Bio MPE Security Keys
[Passwordless for Windows] Verify signing on package update
[Platform] Breaking upgrades to the server
[Platform - Database] Extend length of raw data
[Platform - FIDO2] Update Fido2Authenticator Lib with MASA fix
[Platform - Keycloak] Optimize feature enablement fetching
[Platform - Logging] fidogateway: Log decoded rawdata
[SDK for iOS] Make HYPRiOSReferenceApp consume XCFrameworks on master builds

Bug Fixes

[Adapt] Fixed: Login Limits fails push notification with error 'message attr missing in policy response'
[Adapt] Fixed: Push bomb prevention switches to QR authentication; PRE_WEB_AUTH evaluation point fails if QR authentication fails
[Adapt] Fixed: Settings: Table border is distorted due to the new column 'Adapt unavailable'
[Adapt] Fixed: Signals: CrowdStrikeAID information is missing in the resulting Signal report because of character casing used in Passwordless
[Adapt] Fixed: Unable to register device due to 'Failed to load extensionId: AdaptExtId' error
[Adapt] Fixed: Workstation Authentication policy 'network' field is missing and the option is present in the high-level drop-down
[Adapt; Mobile App for Android] Fixed: Android Signal is sent with authentication/requests 'REQUEST_SENT' status instead of 'COMPLETE' status
[Adapt; Mobile App for iOS] Fixed: Signals - app minimization generates 3 signal requests for each registration
[Adapt; Platform - Keycloak] Fixed: Keycloak's 'Authentication Upgraded Message' sometimes doesn’t get displayed
[Affirm] Fixed: 500 on attempting to relogin into Control Center after completing affirm flow
[Affirm] Fixed: Backward compatibility issue: Removal of Manager role in favor of Approver
[Affirm] Fixed: Cannot fetch Approver when its set to Manager and not Someone Else
[Affirm] Fixed: Data fields with null values populating with text string "null"
[API] Fixed: Adjust Broken FIDO2 Update User API URL
[Control Center] Fixed: Audit Trail says that registration of paired IDEMIA card is unknown
[Contorl Center] Fixed: Device Manager 2.0: Fails to update Device Name
[Control Center] Fixed: Device Manager 2.0: Failure to delete device with invalid date
[Control Center] Fixed: Device Manager 2.0 Onboarding: Welcome email for non-ControlCenterAdmin apps leads to standard Device Manager index page and not the Onboarding page
[Control Center] Fix Event listener assignment on login page
[Control Center] Fixed: Many instances of PersistenceException error
[Control Center] Fixed: RBAC (Haas): User is unable to redirect to Okta
[Control Center - Extensions] Fixed: Associate Extensions: WebHooksExtId option is not visible clearly
[Control Center - Extensions] Fixed: Webhooks: Authentication hook throws 'Failed to execute extension' error
[Control Center - Integrations] Fixed: Okta: Integration is not cleaned up when deleting Okta user whose username != email
[Control Center - Integrations] Fixed: Okta: Query for application fails
[Control Center - Integrations] Fixed: Okta: Remove integrations data from response
[Control Center - Integrations] Fixed: OneLogin: Cannot copy "Client Secret for OneLogin Trusted IdP"
[Control Center - Integrations] Fixed: RADIUS doesn't work with 9.1
[Control Center - Intgerations; Passwordless - Both] Fixed: Issue with Desktop SSO, Okta, and Aliases
[Mobile App - Both] Fixed: Enterprise Passkey: Mobile App crashes on authenticating after receiving the user presence prompt via WiFi
[Mobile App - Both; Events] Fixed: Fix Events during pairing via Device Manager in the Mobile App
[Mobile App for Android] Fixed: Device-specific: App crashes upon launching after install
[Mobile App for Android] Fixed: Scanner does not open and the QR icon is not displayed if the app is in the background and we tap “Start QR Scanner” via shortcuts
[Mobile App for iOS] Fixed: Mobile App foreground is not generating signals anymore
[Mobile App for iOS] Fixed: Screen Widget - Dark mode doesn't show the machine name
[Mobile App for iOS] Fixed: Workstation unlock crashes the app if location is not enabled
[Passwordless for macOS] Fixed: read qrCodeUrl configuration from hypr.json
[Passwordless for macOS] Fixed: TrustKit crashes on unsupported algorithm
[Passwordless for Windows] Fixed: Can't upgrade a customer-specific Passwordless 8.5.2 build to Passwordless 9.1.0
[Passwordless for Windows] Fixed: Custom Branding: No spacing between "View More Instructions" button and Contact Support link
[Passwordless for Windows] Fixed: Multiple Audit Trail Events queued due to an exception caused by empty RpAppID during Passwordless service startup
[Passwordless for Windows] Fixed: Signal does not sent "no location avail" if Location is Disabled
[Passwordless for Windows] Fixed: UI in Enterprise passkey flow has extra line space between each line
[Passwordless for Windows] Fixed: Unable to complete login to Remote workstation using registered device
[Passwordless for Windows] Fixed: Passwordless should trim leading/trailing whitespace from registry values
[Platform - Keycloak] Fixed: Modules refactor - Push bomb prevention - QR code is not getting displayed
[Platform - Migration] Fixed: Migration from 8.7 to 9.1 fails with error
[SDK for Java/Android/iOS] Fixed: Authentication fails with Error 114060 error

8.7.1 - Patch 2024-01-24

New Features and Feature Changes

[All HYPR] American with Disabilities Act (ADA) Fixes
- [All HYPR] American with Disabilities Act (ADA) High Priority Items
- [All HYPR] American with Disabilities Act (ADA) High Priority Items Pass 2
[Control Center - Integrations] Azure: HYPR Enterprise Passkey: Support for different usernames and multiple credentials
- [Control Center - Integrations] Azure: User not moved back to 'Paired with HYPR' group after deleting the FIDO2 credentials from the Mobile App
- [Passwordless for Windows] Passwordless Client fails to validate pass\pin on local account pairing

Enhancements

[Adapt] Change the ‘WhiteList’ terminology ‘AllowList’ to be more politically correct
[Adapt] Extension and Evaluation points Documentation ticket
[Adapt] PolicyEvaluationService.evaluatePolicy - Fix the evalDataStartDate and evalDataEndDate values in the log
[Adapt] Remove 'Disable Adapt' toggle from Keycloak
[Adapt] Rename the policy evaluation point
[Adapt; Documentation] Documentation ticket
[All HYPR] CVE Fixes
[API] FIDO2: Should be able to update displayName
[API] Add username validation in fido/get
[Control Center] Allow Non-ASCII characters through Control Center firewall in request headers
[Control Center] Remove dynamic content in error parameter
[Control Center] Security key pre-registration hook before certificate is requested
[Passwordless for Windows] Allow more than five paired devices
[Platform - Keycloak] Adjust 'Use a dynamic link for web login on mobile devices' toggle logic to account for Adapt flow

Bug Fixes

[Adapt; Mobile App for Android] Fixed: Signals: Mobile App asks for location and phone call permission 'after' the registration is complete
[Adapt; Mobile App for Android] Fixed: Signals: machineId is used as 'machineUserName' instead of 'username'
[Adapt] Fixed: Event ADAPT_POLICY_ASSIGNMENT_REMOVED doesn't have policy ID info
[Adapt] Fixed: Keycloak doesn't display user friendly message when user is Blocked
[Adapt] Fixed: Login Settings: HYPR Adapt Settings section - 'Adapt Unavailable Fallback' column is not displayed
[Adapt] Fixed: Sending continuous signals for each profile
[Adapt] Fixed: Technical Edits
[Adapt] Fixed: Unable to assign policy to an rpApp using its own Access token
[Control Center] Fixed: Device Manager 2.0 Onboarding: Can't enroll two passkeys or two mobile devices back-to-back
[Control Center] Fixed: Device Manager: User is not able to complete authentication and UI shows "Your account has been temporarily blocked"
[Control Center] Fixed: Web Login Onboarding tour QR code refresh fails
[Control Center - Integrations] Fixed: Azure: Server needs to remove FIDO2 credential on FIDO2_DEVICE_DEREG not workstation delete ???
[Control Center - Integrations] Fixed: Enterprise Passkey: Grey workstation bubble displayed when same user is paired from a different workstation and a security key already exists
[Control Center - Integrations] Fixed: Enterprise Passkey: Issue with Windows 11 and BLE and iOS
[Control Center - Integrations] Fixed: Okta: Migration error when name != 'HYPR Authenticator'
[Control Center - Integrations] Fixed: Okta v1->v2 migration: Artifacts in Okta not deleted/Error when deleting users after migration/Side effect around existing users
[Control Center - Integrations; Mobile App for Android] Fixed: Enterprise passkey: Workstation bubble on Mobile App gets replaced on pairing two different workstations logged in with same Azure account
[Mobile App - Both] Fixed: Customer problem registering a device
[Mobile App for Android] Fixed: 404 error when Android OS 13 device trying to authenticate with QR via native camera scanner unless supported web addresses is enabled
[Passwordless for macOS] Fixed: PKG Scripts lead to root privilege escalation
[Passwordless for macOS] Fixed: Requesting certificate from AD fails with Kerberos error rpc_s_auth_not_us
[Platform - Keycloak] Fixed: Keycloak JSON logging
[Platform - Keycloak; Adapt] Fixed: Empty Adapt rpapp config parse error in Keycloak

9.0.0 - GA 2024-01-17

New Features and Feature Changes

[Adapt] Apply Workstation proximity Policy DURING computer unlock
- [Adapt] Ingest workstation signals
- [API] Add signals API for workstations
[Adapt] Event Handlers: Alpha
- [Adapt] Event Handlers: Code and Test JSON Event: Implement linter to handle syntax errors
- [Adapt] Event Handlers: Configuration and Test tab UI enhancements
- [Adapt] Event Handlers: Configuration tab - remove cron scheduler for ‘data enricher’ and ‘action executor’ type
- [Adapt] Event Handlers: Configuration tab - secured values like passwords, keys should not be shown as plain-text
- [Adapt] Event Handlers: Introduce 'logLevel' and add machineUserName in the test Event request body
- [Adapt] Event Handlers: Add support for DEFINING action executor
- [Adapt] Event Handlers: Add support for DEFINING pull data collectors
- [Adapt] Event Handlers: Add support for EXECUTING action executors
- [Adapt] Event Handlers: Add support for SCHEDULING pull data collectors
- [Control Center] UI: Add support for Event Handlers
- Bug Fixes:
  - [Adapt] Fixed: Event Handlers: ctx.httpPost() or ctx.saveEvent() is executing twice
  - [Adapt] Fixed: Event Handlers: Data collector keeps executing even when it is disabled
  - [Adapt] Fixed: Event Handlers: Each line of Handler code is logged as a separate log
  - [Adapt] Fixed: Event Handlers: Event enricher - Able to overwrite the existing columns such as machineUserName, eventName, sessionId, etc
  - [Adapt] Fixed: Event Handlers: Event saved from the Handler Code doesn't show up with search Events
  - [Adapt] Fixed: Event Handlers: Tests Events have missing Tenantld value
  - [Adapt] Fixed: NullPointerException in getAllServerPolicyAssignments()
[Adapt] Signal data from Workstation
- [Adapt] Signals: Workstation data II
- [Adapt] Signals: Workstation send additional signals data
[Affirm] Affirm Identity Verification Minimum Viable Product (MVP)
- [Affirm] OnFIDO MVP Integration
- [Affirm] Activity Log
- [Affirm] Activity Log details
- [Affirm] Activity Log table
- [Affirm] Application Settings: Application connection section with calls to the APIs
- [Affirm] Application Settings: Onboarding/recovery workflow settings section; Employee Location and Identity settings sections
- [Affirm] Application Setup tab
- [Affirm] Application Setup tab
- [Affirm] Approver Assignment tab
- [Affirm] Approver Assignment tab
- [Affirm] Audit trail tab
- [Affirm] Audit trail tab
- [Affirm] Control Center UI changes
- [Affirm] Changes in the report card
- [Affirm] Continue button on the chat/movie should be greyed out
- [Affirm] Costs tracking auditing additional details substructures + error auditing additional details substructures for various costs-generating third party services for Affirm
- [Affirm] Fix Control Center verification flow tab
- [Affirm] Fix Control Center verification model
- [Affirm] Onboard / recover flow chooser
- [Affirm] Phone step
- [Affirm] Phone step
- [Affirm] Rate Limiting and Blocking
- [Affirm] Referencing and saving image is broken
- [Affirm] Remove PII from logs
- [Affirm] Replace copy with generic copy; fix wording
- [Affirm] Settings: Create empty tabs view for further UI work; Application Settings/Audit Log/Activity Log
- [Affirm] Space in the SMS code fails
- [Affirm] TAP not done yet
- [Affirm] Use OnFIDO production credentials
- [Affirm] UX improvements: URLs pointing to specific places in the UI
- [Affirm] Verification Flow tab
- [Affirm] Verification Flow tab
- [Affirm; API] Application Connection API: Assigning/Unassigning/Enabling/Disabling
- [Affirm; API] Onboarding/Recovery workflow settings API; Approver/Approvers/Employee Location/Identity
- [Control Center] Remove legacy field and database toggleableByAdmin column from FeatureFlag entity and rp_feature_flags table for 9.0 release
- [Control Center] Introduce Affirm paid-tier plan feature enablement
- [Control Center; API] rp/api/versioned/features/toggle/{featureName} Add guard if-statement code for HYPR service account only (API endpoint) and add it only for on-cloud tenants V2 in Control Center backend server code
- Bug Fixes:
  - [Affirm] Fixed: additionalDetails needs to be .toString
  - [Affirm] Fixed: When first assigning an application, the verification flow settings require a page refresh to properly update
  - [Affirm] Fixed: If Okta application is assigned and you attempt to switch to Azure, Okta remains the application
  - [Affirm] Fixed: If you get an error generating TAP code you should display an error to the user
  - [Affirm] Fixed: Missing costs tracking method call in RequesterJoinsChatAction
  - [Affirm] Fixed: On a second pass of the same user, if they have a picture on file you can just go to video however you still need to do the document upload to continue
[All HYPR] Consuming Device Signals, Control Center Integration, Login Limits and Initial Keycloak Integration
- [Adapt; Mobile App - Both] Send latest signal with the authentication request
- [Control Center] Event logging performance in v2
[All HYPR] Single Registration: Web-to-workstation: Deregistration/Re-enroll
- [All HYPR] Single Registration: Web-to-workstation: removing devices
- [All HYPR] Single Registration: Web-to-workstation: trigger push notification on migrated registrations
- [Mobile App for Android] Implement single registration on the Android app side
[Control Center] Deprecate and remove Control Center licensing
- [Control Center] Drop licensing in 9.0
- [Control Center] Drop licensing in HYPR-as-a-Service (HaaS)
[Control Center - Integrations] Okta: Universal Principal Name (UPN) in Integrations
- [Control Center - Integrations] Add email column to pending users tab UI
- [Control Center - Integrations] Add username column to Enroll User Directory List UI
[Control Center - Integrations] UX Updates to accommodate Azure -> Entra Branding Changes
- [Control Center - Integrations] Azure integration branding
- [Mobile App for Android] Wording changes to accommodate Azure -> Entra
- [Passwordless for Windows] Wording changes to accommodate Azure -> Entra
[Documentation] New Documentation Portal
- [Documentation] Content readiness - 9.0
- [Documentation] Style guide - 9.0
[Mobile App for Android] Q1 2024 Tech Debt
- [Mobile App for Android] Enhance PIN protection
- [SDK for Android] Update to latest Dexguard version
- [SDK for Android] Update to latest iXGuard
[Passwordless - Both] Security Keys Default/Insecure PIN Check
- [Passwordless for macOS] Block Default/Insecure Security Key PIN
- [Passwordless for Windows] Block Default Security Key PIN
[Passwordless for Windows] Support for YubiKey Bio Security Keys
- [Passwordless for Windows] Finish UI; Revamp Security Key and Smart Card support (Part 6)
- [Passwordless for Windows] Update bundled YubiKey mini-driver to version 4.5.2.243
[Platform - Keycloak; Control Center] Keycloak Authenticator Refactoring Phase 2
- [Control Center] Create feature for 'remember me' in Control Center
- [Platform - Keycloak] Custom migration for existing tenant to move OneLogin integration to use the new Keycloak OIDC flow/authenticators
- [Platform - Keycloak] Desktop SSO support
- [Platform - Keycloak] Fix new Okta integration to use the new Keycloak OIDC flow/authenticators
- [Platform - Keycloak] Fix new Ping DV and BT integrations to use the new Keycloak OIDC flow/authenticators
- [Platform - Keycloak] Use 'remember me' and bypass username feature from Control Center in Keycloak

Enhancements

[Adapt] Create Empty Risk Reports page
[Adapt] Policy Evaluation request log - Need evaluationPoint, username, lambdaRequestID details
[Adapt] Remove 'Disable Adapt' feature from Keycloak
[Adapt] Risk Engine: Log the Events used for policy evaluation in CloudWatch
[Adapt] Unable to assign policy to evaluation point in Control Center UI
[Affirm] Minimum Viable Product (MVP)
[All HYPR] Americans with Disabilities Act (ADA) Fixes
[All HYPR] CVE Fixes
[All HYPR] Single Registration: Web-to-workstation: authenticators validation on setting rpAppIdWs on web rpAppId
[All HYPR] Update product to remove reference to "HYPR Zero" and "Free"
[Control Center] FIDO: FIDO Alliance Missed Step Error
[Control Center] Global jQuery upgrade and consolidation
[Control Center] Health check should confirm DB and cache are writable in addition to readable
[Control Center] Refactor IDP User Management component for reuse in other places
[Control Center - Integrations] Fix all integration beta banners to include the new HYPR look and feel
[Errors] ErrorCode file contains two 1206045 errors; one should be 1206035
[Mobile App - Both] Fixed Events during pairing via Device Manager
[Mobile App for Android; SDK for Android] Dependency Bump
[Mobile App for Android] Remove support for Android 6 and 7
[Mobile App for Android] Upgrade target version to 34
[Passwordless - Both] Security Key pre-registration hook - [Part I]
[Passwordless - Both] Security Keys "Management Key" Handling
[Passwordless - Both] Security Keys Default/Insecure PIN Check
[Passwordless for macOS] Align "Contact Support" messages between macOS/Windows
[Passwordless for macOS] Desktop SSO "success" HYPR Passwordless message should close itself after timeout
[Passwordless for macOS] Remove workaround for Fast User Switch
[Passwordless for macOS] Update list of macOS models
[Passwordless for macOS] Upgrade notarization to use notarytool instead of altool
[Passwordless for Windows] Reduce idle CPU usage by HyprOneService
[Passwordless for Windows] Upgrade NuGet dependencies
[Platform - Keycloak] Adjust 'Use a dynamic link for web login on mobile devices' toggle logic to account for Adapt flow

Bug Fixes

[Adapt] Fixed: Events search API throws 500 status code when startDate is greater than endDate
[Adapt] Fixed: For FIDO2 authentication, POST_FIDO2_AUTH and POST_WEB_AUTH is not getting evaluated
[Adapt] Fixed: Integration Test - AdaptEvHandlerTest.saveEventHandler() fails with cronSchedule
[Adapt] Fixed: iOS Signal - Wifi bssid and rssi are null and batteryPercentage is wrong. Only the device connected Wifi is displayed
[Adapt] Fixed: iOS Signal testing - During registration, 'Motion and Fitness Activity' permission is displayed twice
[Adapt] Fixed: Policy assignment - 'Adapt Unavailable Fallback' value is not getting saved
[Adapt] Fixed: Risk engine - evalEventCount is not matching with the actual Event count
[Adapt] Fixed: Sending continuous signals for each profile
[Adapt] Fixed: Unable to assign policy to an rpApp using its own Access token
[Adapt] Fixed: WEBSITE_AUTH doesn't have 'eventTags' column populated due to which it doesn't get propagated to Dynamo DB
[Control Center] Fixed: Error message is not clear when setting invalid value to “rpAppId of the workstation application"
[Control Center] Fixed: QR Fallback is disabled when 'QR Auth' feature is enabled
[Control Center] Fixed: QR Fallback is not enabled for controlCenterAdmin rpApp by default
[Control Center - Integrations] Fixed: Keycloak checks for non-existent feature for QR login
[Control Center - Integrations] Fixed: multipleAuthn SAML attribute is not present when user authenticates with passkey
[Mobile App for iOS] Fixed: User fails to complete Authentication process
[Passwordless - Both] Fixed: Error -1 when we use the wrong PIN with YubiKey Bio MPE
[Passwordless - Both] Fixed: Error during removing machine certificates
[Passwordless for macOS] Fixed: PKG Scripts Lead to Root Privilege Escalation
[Passwordless for macOS] Fixed: Doesn't throw error in rp/wsapi/settings with invalid SSL PIN
[Passwordless for Windows] Fixed: Can't retrieve management key with older YubiKey firmware
[Passwordless for Windows] Fixed: Error string is cut off or shortened
[Passwordless for Windows] Fixed: Extra whitespace in UI when unpairing YubiKey Bio MPE
[Passwordless for Windows] Fixed: File versioning and signature problems
[Passwordless for Windows] Fixed: File Write by Diagnostics Console Leads to Boot Loop
[Passwordless for Windows] Fixed: Generic error message with error code is displayed on entering the current PIN with 5 digits and less in update security key PIN flow
[Passwordless for Windows] Fixed: QR code screen in HYPR Passwordless spells HYPR incorrectly
[Passwordless for Windows] Fixed: Shortcuts not removed during uninstall with custom app name
[Passwordless for Windows] Fixed: Some options in "protected" registry key may be lost during upgrade
[Passwordless for Windows] Fixed: Two extra lines displayed next to the error message for Confirm PIN field in the biometric key/smart card unpair flow
[SDK for Java] Fixed: Registration fails with 'Exception in thread "main" java.lang.UnsupportedClassVersionError' error in latest 'java-client-9.1.0-SNAPSHOT.jar'

8.7.0 - GA 2023-12-13

New Features and Feature Changes

[Adapt] Apply policies during WS login
- [Control Center] Feature enablement for sending continuous device signals
- [Mobile App for Android] Send device signals upon the app entering the foreground
- [Mobile App for iOS] Send device signals upon the app entering the foreground
- [Mobile App for iOS] User-friendly error dialog for Passwordless Unlock blocked
[Adapt] Configure Login Limits
- [Adapt] Create Policy Configuration UI in Control Center
- [Adapt] Create Policy Configuration UI for Login Limits
- [Adapt] Add feature for HYPR Login Limits
- [Adapt] Updated verbiage for HYPR Adapt Phase 1
[Adapt] Consuming Device Signals, Control Center Integration, Login Limits and Initial Keycloak Integration
- [Adapt] Create policy UI
- [Adapt] Send latest browser signal with the authentication request
- [Adapt] Upgrade cloud watch lambda function to handle JSON logs
- [Adapt; API] Expose policy API for the UI
- [Adapt; API] Separate policy test endpoint
- [Adapt; Events] Read/Write Events by deviceId handle
- [Adapt; Events] Route Events to the dataLake
- [Adapt; Mobile App for Android] Send location signals from the Mobile App during the Workstation Unlock
- [Adapt; Mobile App for iOS] Send location signals from the Mobile App during the Workstation Unlock
- [API] Enhance APIs to take in new WEB signals
- [API] Enhance Control Center APIs to take in new mobile signals
- [Control Center] Add both JSON and KV logging
- [Control Center; API] Remove TenantUUID references in all Control Center API calls
- [Mobile App for Android] User-friendly error dialog for Passwordless Unlock blocked
[Adapt] Create and Manage Risk Policies
- [Adapt] Add Risk Policy Assignment UI to Login Settings in V1
- [Adapt] Add Risk Policy Assignment UI to Login Settings in V2
- [Adapt] Build out new Control Center controller for Policy CRUD API calls
- [Adapt] Create a New Policy popup
- [Adapt] Create an empty policies screen
- [Adapt] Create policy content structure for create/update calls
- [Adapt] Create UI elements for main authentication Policy page
- [Adapt] Update Risk Policies Empty State UI
[Adapt] Login Limits - Block User
- [Adapt] Create new UI screen for Authentication Blocked error
- [Adapt; API] Build out Policy Control Center controller to include evaluation API call to AWS
- [Adapt; Errors] Create error message, error codes and audits for Authentication Blocked via Risk Service
- [Platform - Keycloak] Add error messages and code for Control Center 'Authentication Blocked' responses
[Adapt] Passwordless client updates
- [Passwordless for macOS] Send data via WSAPI Signals endpoint during Unlock
- [Control Center] Add Signals frequency to ServerConfig object in Settings
- [Control Center] Store Signals data in the database
[All HYPR] HYPR Enterprise Passkey - BLE and WiFi (Roaming)
- [Mobile App for iOS] Bluetooth Screen Changes
- [Mobile App for Android] Add Roaming Capabilities
- [Mobile App for Android] Bluetooth Screen Changes
- [Mobile App for Android] (Enterprise Passkey BLE) Support Offline mode
- [Mobile App for iOS] Implement BLE Offline Banner
- [Mobile App for iOS] Add Roaming Capabilities
- [Passwordless for Windows] Display QR Code on credential provider on Azure Joined
- [SDK for FIDO2] Add Roaming Capabilities
- Bug Fixes:
  - [Passwordless for Windows] Windows not receiving UDP broadcast when mobile application closed
[All HYPR] SSL/TLS Pinning enhancements for Mobile/Desktop
- [API] rp/wsapi/settings and rp/deviceapi/settings return 400 when invalid parameters are sent
- Bug Fixes:
  - [Passwordless - Both] Empty/fatal 401 response to expired endpoint API tokens has been fixed
[Control Center - Integrations] Beyond Trust Integration
- [Control Center - Integrations] Beyond Trust: New tile in Integrations
- [Control Center - Integrations] Beyond Trust: Beta UI banner
- [Control Center - Integrations] Beyond Trust: Generalized the OIDC integration
- [Control Center - Integrations] Beyond Trust: Feature enablement
- [Control Center - Integrations] Beyond Trust: Administration console
[Control Center - Integrations] HYPR Enterprise Passkey Enhancements Part II
- [Control Center - Integrations] Azure Enterprise Passkey: Changes to support 3rd-party FIDO2 registration
- [Control Center - Integrations] Azure Enterprise Passkey: Delete the correct group data when we delete a user and a device for local user
- [Control Center - Integrations] Azure Enterprise Passkey: Skip group population when username is not an email for support of local user
- [Control Center - Integrations] New user management columns
- Bug Fixes:
  - [Control Center] The machineUserPrincipalName property is now displayed on the device details screen
[Control Center - Integrations; Mobile App - Both; SDKs for Android and iOS] HYPR Enterprise Passkey for Entra/Azure: Support for different usernames and multiple credentials
- [Mobile App for Android] Update mobile device to accommodate "Different FIDO2 Username" solution
- [Mobile App for Android] Accessibility Sweep for Enterprise Passkeys
- [Mobile App for Android] Add credential information to Debug Information Screen
- [Mobile App for Android] Display banner on MY COMPUTERS if no FIDO2 keys are paired
- [Mobile App for Android] History tracked on credential Basis
- [Mobile App for Android] Update FIDO2 prompts to be more generic
- [Mobile App for Android] UX: Azure domain-joined: Create new bubble type on "MY COMPUTERS" when QR Code is scanned
- [Mobile App for Android] UX: Update "MY SECURITY KEY" behavior
- [Mobile App for iOS] Multi-user UI
- [Mobile App for iOS] Add credential information to Debug Information Screen
- [Mobile App for iOS] Audit Trail Sweep for Enterprise Passkeys
- [Mobile App for iOS] Display banner on MY COMPUTERS if no FIDO2 keys are paired
- [Mobile App for iOS] History tracked on credential basis
- [Mobile App for iOS] UX: Azure domain-joined: Create new bubble type on "MY COMPUTERS" when QR Code is scanned
[Control Center; Mobile App - Both; SDKs for Android and iOS] Single Registration: Existing users can be added to Single Registration without having to de-register and re-register
- [Control Center] Single Registration with associated workstation RPApp - Part 1
- [Control Center - Integrations] Migration implementation and integration + Control Center UI changes
- [Mobile App for Android] Migration implementation and integration
- [Mobile App for Android] Single Registration with associated workstation RPApp - Part 1
- [Mobile App for iOS] Migration implementation and integration
- [Passwordless for macOS] Add fields to QR code
- [Passwordless for Windows] Add fields to QR code
[Passwordless for Windows] Security Key and Smart Card support
- [Passwordless for Windows] Revamp Security Key and Smart Card support (Part 4)
- [Passwordless for Windows] Revamp Security Key and Smart Card support (Part 5)
[Platform - Keycloak] Improvements to Keycloak integration: select login authenticator; remember me
- [Platform - Keycloak] Handle remember me functionality
- Bug Fixes:
  - [Platform - Keycloak] Fix page blinking on cancel for QR / Push
[SDKs for Android, Flutter, iOS] Mobile cross-platform SDK wrapper
- [SDK for iOS] Create the HYPRWrapper for iOS native
- [SDK for Android] Create the HYPRWrapper with common interface for Android sdk
- [SDK for Flutter] Add the possibility for registration with QR code

Enhancements

[Adapt] Update Risk Policies table to handle custom policies
[Adapt; API] Add API for manually unblocking a user by admins
[API] Add machineUserNames field to iOS signals call
[API] Add machineUserNames field to the Android signals call
[Control Center] Alias lookup now considers the RP application when generating results
[Control Center] Device signals include browser info (CIAM device recognition)
[Control Center] FIDO2 Metadata files are now generated for passkeys providers
[Control Center] Health and Logs page in Control Center has been removed in favor of Event Hooks and Analytics
[Events] Missing fields in asynchronously saved Events
[Passwordless for Windows] Default security key PINs are now blocked
[Passwordless for Windows] Revamp Security Key and Smart Card support (Part 3)
[SDK for Android] add logs for zendesk 7752
[SDK for Android] Prompt messages for new permissions
[SDK for iOS] Device registration now collects the specific device model

Bug Fixes

[Control Center] Fixed: FIDO-only flow Fallback Authentication does not apply when the feature is enabled
[Control Center - Integrations] Fixed: Azure: Error when service account password have quotes in it
[Control Center - Integrations] Fixed: Extension attributes have been corrected to load properly on startup
[Control Center - Integrations] Fixed: Okta: Can't delete username with + signs from Keycloak
[Control Center - Integrations] Fixed: Okta: Fixed issues with deleting users from Okta
[Mobile App for Android] Fixed: Corrected a 404 error with dyamic links when Android OS 13 / OS 11 Pixel devices attempted authentication with QR using the camera
[Mobile App for iOS] Fixed: FIDO registration Events not previously being recorded are now logged in the Audit Trail
[Passwordless - Both] Fixed: The Java random number generator causing timeouts during QR code scanning has been fixed
[Passwordless - Both] Fixed: When pairing with HYPR, the "Security Key" option no longer displays if it is not meant to
[Passwordless for macOS] Fixed: Machine name and username display correctly in the password dialog on macOS Ventura
[Passwordless for macOS] Fixed: With passwordless enforcement enabled, password labeling has been corrected to reflect the available options
[Passwordless for Windows] Fixed: HYBRID Entra/Azure machines now hide the Security Key option when the certificate template is not defined
[Platform - Keycloak] Fixed: Desktop SSO alias gets removed from Keycloak upon user deletion; previously in some cases it did not
[SDK for Android] Fixed: After deregistration, the authenticationCounter resets properly for the next authentication attempt

8.5.2 - Patch 2023-11-09

Enhancements

[All HYPR] CVE Fixes
[All HYPR] Fix CVE-2023-22102
[All HYPR] Single Registration: Workstation-to-web: Issues with multiple certificates in loginCert chain
[Control Center] Relax user validation slightly for FIDO2
[Passwordless for Windows] UI customization for customer

Bug Fixes

[Control Center] Fixed: Device Manager error listing devices for user
[Events] Fixed: Missing fields in asynchronously saved Events

8.6.0 - GA 2023-10-25

New Features and Feature Changes

[Adapt] Create and Manage Risk Policies
- [Adapt; API] (Frontend) Build out create policy POST API calls for front-end, tie to UI
- [Adapt; API] (Frontend) Build out authentication Policy GET/DELETE calls; tied to UI elements
[Adapt; Workforce Access Client - Both] Q4 Updates
- [API] Create /wsapi Signals Endpoint
- [Control Center] Signals now are recorded in Audit Trail Events
[All HYPR] Consuming Device Signals, Control Center Integration, Login Limits and Initial Keycloak Integration
- [Adapt; API ] Add Timeout to Adapt Evaluation API
- [Mobile App for Android; SDK for Android] Send location signals from the Mobile App during Workstation Unlock
- [Mobile App for iOS; SDK for iOS] Send location signals from the Mobile App during Workstation Unlock
[Control Center; API] FIDO2 Transports in HYPR API Responses
- [API] FIDO2: The default value for the transports attribute in the /fido2/assertion/options Response Body has been changed to an empty set; and the transports attribute is now a string data type
- [Control Center - FIDO2] The transports attribute in /fido2/assertion/options is now a string data type
[Control Center - Integrations] Azure: HYPR Enterprise Passkey: Support for Different Usernames and Multiple Credentials
- [Mobile App - Both; Passwordless - Both] HYPR now accounts for multiple devices or workstations for a single user
- [Mobile App - Both; Passwordless - Both] Part2 - FIDO2 Username different than the HYPR QR Code pairing Username
[Control Center - Integrations; Platform - Keycloak] Authenticator Refactoring; OneLogin new Integration
- [Platform - Keycloak] Back End: Desktop SSO module
- [Platform - Keycloak] Adjust QR code authenticator for OneLogin
[Passwordless - Both] Desktop SSO Enhancements
- [Passwordless - Both] Desktop SSO status endpoint should return username that was requested by the web
- [Passwordless - Both] Desktop SSO support for Web username aliases

Enhancements

[Adapt] Update policy UI to new branding
[Adapt; API] Confirm the PUT calls in Adapt policy UI are functional
[All HYPR] CVE Fixes for 8.6.0
[API] Separate /login and /recover endpoints
[Control Center - Integrations; Platform - Keycloak] ADFS Plugin V2: Add final Keycloak pieces to support dynamic links
[Control Center; Adapt] Add Adapt Policies enablement to UI
[Mobile App - Both] Add additional device information to the logs
[Mobile App for Android; SDK for Android] Update androidx security library to alpha-06
[Mobile App for iOS] Fixed: Certificate Renewal Failures in Prod
[Passwordless for Windows] Support for YubiKey Bio Security Keys

Bug Fixes

[Adapt] Fixed: 500 error when trying to update existing policy
[API] Fixed: Logging response is adding double-double quotes that is throwing off CSV positioning upon log ingestion
[Control Center - Integrations] Fixed: Improve SAML Messages security
[Control Center - Integrations] Fixed: Okta: Alias support should not be case-sensitive
[Control Center] Fixed: FIDO2: Authentication fails for unknown AAGUID
[Control Center] Fixed: Deleting an rpapp does not cascade correctly for UAFTransaction
[Control Center] Fixed: Server returns incorrect error codes (400/500) in response when the properties are tampered in the install token exchange request
[Passwordless for macOS] Fixed: Consolidate Audit Trail Event names into a single source file for better accounting
[Passwordless for macOS] Fixed: Devices disappear from paired devices
[Passwordless for macOS] Fixed: MacOS Sonoma cannot register new devices
[Passwordless for macOS] Fixed: Sonoma: Text missing on the client when trying to unpair a device
[Passwordless for macOS] Fixed: Unable to unlock using HYPR after upgrade from 8.4 to 8.5
[Passwordless for macOS] Fixed: Workforce Access UI on macOS 14 Sonoma renders UI in a different way
[Passwordless for Windows] Fixed: Add quotes to the Bonjour service path
[Platform - Keycloak] Fixed: Keycloak not creating cookies for username
[Platform] Fixed: Liquibase changelog database is not cluster-friendly
[SDK for FIDO2] Fixed: iOS does not resume FIDO2 BLE advertising when the Mobile App is closed and reopened

8.5.1 - Patch 2023-10-18

New Features and Feature Changes

[Control Center - Integrations] Azure HYPR Enterprise Passkey Enhancements Part II
- [Control Center - Integrations] Enterprise Passkey: Delete one and only one device from Control Center
- [Control Center - Integrations] Enterprise Passkey: Delete one and only one device from Mobile
- [Control Center - Integrations] Enterprise Passkey: Delete device from Control Center when we have 2 device paired with the same Passwordless Client
- [Control Center - Integrations] Enterprise Passkey User Management: Display user in Pending table if they remove their device, regardless of if we send email
- [Control Center - Integrations] Enterprise Passkey: Delete "Pair with HYPR" workstation from mobile device does not delete from server
- Bug Fixes:
  - [Control Center] User Management: Single user with multiple devices appears as separate entries
[Control Center - Integrations] HYPR Enterprise Passkey - BLE and WiFi Enhancements (Roaming) Bug Fixes
- [Passwordless for Windows] Fixed: Bonjour service does not start automatically after upgrading Passwordless Client
- [Passwordless for Windows] Fixed: Windows not receiving UDP broadcast when HYPR Mobile App is closed

Enhancements

[Adapt] Office code changes needed
[Control Center] Alias lookup needs an option to include rpappid
[Mobile App for iOS; Events] Valid Audit Events for FIDO2 registration: add message to Events
[Passwordless for macOS] Remove password unlock on macOS
[Platform] Add support for "hypr.fido2.mds.enable" vault parameter in v2

Bug Fixes

[Control Center] Fixed: FIDO2: Authentication fails for unknown AAGUID
[Control Center - Integrations] Fixed: Azure: No icon displayed after deleting user from "Paired with HYPR" or "Paired with Azure"
[Control Center - Integrations] Fixed: Okta: Always create short name alias when an email is registered
[Control Center - Integrations] Fixed: Okta: No icon next to username after deleting device from Magic Link
[Mobile App for iOS] Fixed: Fix certificate renewal failures in Prod
[Passwordless for macOS] Fixed: Devices disappear from paired devices
[Passwordless for macOS] Fixed: macOS Sonoma cannot register new devices
[Passwordless for macOS] Fixed: Passwordless Client UI on macOS 14 Sonoma renders UI in a different way
[Passwordless for macOS] Fixed: Sonoma: Text missing on Passwordless Client when trying to unpair a device
[Passwordless for macOS] Fixed: Unable to unlock using HYPR after upgrade from 8.4 to 8.5
[Platform] Fixed: Gray screen issues in embedded browsers
[Platform - Keycloak] Fixed: Network cache TTL is not working
[Platform - Keycloak] Fixed: Setting a custom theme does not work in 21.1.2
[SDK for FIDO2] Fixed: iOS does not resume FIDO2 BLE advertising when HYPR Mobile App is closed and reopened

8.5.0 - GA 2023-09-27

New Features and Feature Changes

[Control Center] Device Manager 2.0
- [Control Center] Device Manager 2.0 Alerts UI Improvements
- [Control Center] Device Manager 2.0 Buttons UI Improvements - [2d part]
- [Control Center] Device Manager 2.0 Devices List Improvements
- [Control Center] Device Manager 2.0 Devices UI Improvements - [2d part]
- [Control Center] Device Manager 2.0 Errors UI Improvements
- [Control Center] Device Manager 2.0 Header UI Improvements - [2d part]
- [Control Center] Device Manager 2.0 Hypr-ui-component-library improvements
- [Control Center] Device Manager 2.0 Modals UI Improvements - [2d part]
- [Control Center] Device Manager 2.0 Punch list - [2nd part]
- [Control Center] Device Manager 2.0 Registration UI Improvements - [2d part]
- [Control Center] Device Manager 2.0 Alerts UI Improvements - [2d part]
[Control Center; Passwordless - Both] Improve Workstation Installation token security controls
- [Control Center] Improve Workstation Installation token security controls
- [Passwordless for macOS] Improve workstation token security controls
- [Passwordless for Windows] Improve workstation token security controls
[All HYPR] Desktop SSO Enhancements
- [API] Desktop SSO status endpoint should return username that was requested by the web
- [Control Center] Send whitelabel URL In Settings
- [Mobile App for Android] Process whitelabel URL In Settings and add to Desktop SSO
- [Mobile App for iOS] Process whitelabel URL In Settings and add to Desktop SSO
- [Passwordless for macOS] Match whitelabel URL or RpServerURL in SSO
- [Passwordless for Windows] Use new settings API to get list of alternate RP server URLs
[Control Center - Integrations] HYPR Enterprise Passkey for Azure - Hybrid Domain-joined Support
- [Control Center] Accommodate both X.509 certificate and FIDO2 binding
- [Control Center] Receive machineUserPrincipalName, machineUserEmail and machineUserDisplayName on QR Code Scan
- [Control Center - Integrations; API] /rp/deviceapi/device/authorize/ws/unlock - remove query did not return a unique result: 2 when paired with Azure
- [Mobile App for Android] Accommodate both machineUsername and machineUserPrincipalName
- [Mobile App for Android] Update app to support both X.509 certificate and FIDO2 binding on a single QR Code scan
- [Mobile App for iOS] Accommodate both machineUsername and machineUserPrincipalName
- [Mobile App for iOS] Update app to support both X.509 certificate and FIDO2 binding on a single QR Code scan
- [Passwordless for Windows] Accommodate both X.509 and FIDO2 binding
- [Passwordless for Windows] Send additional user identity properties during registration
- [Passwordless for Windows] Update UX to accommodate device pairing when both FIDO2 and X.509 are available
- Bug Fixes:
  - [Control Center - Integrations] Azure Native - User not deleted from 'Paired with Azure' when delete initiated from Android device
  - [Control Center - Integrations] HYPR Enterprise Passkey: Hybrid - On the Workstation Lock Screen, there is no field to enter Offline PIN/Recovery PIN
  - [Control Center - Integrations; HYPR Mobile App for iOS] CredentialID in Enterprise Passkey Audit Trail Events does not match with one returned by graph API
  - [Control Center - Integrations; HYPR Mobile App for iOS] FIDO2: Multiple errors and exceptions are observed in Datadog on pairing with Azure
  - [Control Center - Integrations; HYPR Mobile App for iOS] Valid Audit Trail Events for FIDO2 registration are not being tracked
  - [Mobile App for iOS] FIDO2 prompt to log back in doesn't go away even after accepting
  - [Mobile App for iOS] UI: 'machineUserName' is displayed under "My Security Keys' instead of 'machineUserPrincipalName'
  - [Mobile App for iOS] Valid Audit Trail Events for FIDO2 registration are not being tracked
  - [SDK for FIDO2] iOS advertising wrong IP address through DNS Service Discovery
[Control Center - Integrations] HYPR Enterprise Passkey - Bluetooth \ BLE Support (Windows)
- [Mobile App for Android] Work required on HYPR mobile application to accommodate BLE/Bluetooth pairing
- [Passwordless for Windows] Client updates to show BLE as an option
- [Passwordless for Windows] Implement Bluetooth/BLE Support for Enterprise Passkey for Azure
- Bug Fixes:
  - [SDK for FIDO2] After Pairing with Azure, unable to log into Windows OS via BLE
[Platform - Keycloak] Upgrade - Quarkus
- [Platform - Keycloak] Keycloak 21.1.2 is out we should use it as our image
[Passwordless - Both; Mobile App - Both; API] SSL/TLS Pinning enhancements for Mobile/Desktop
- [Passwordless for Windows] Use new settings API to get updated SSL pinning hash from Control Center
- Bug Fixes:
  - [API] 'rp/deviceapi/settings' returns 403 when request contains more than 1 rpApp

[Control Center - Integrations] Azure HYPR Enterprise Passkey Enhancements

[Control Center] Add and persist FIDO2 username from the Event to rp_enrolled_credentials_data
[Control Center] Add FIDO2 username to the UI
[Control Center] Delete enrolledCredentialId from rp_user_device_machine_map
[Control Center] Remove rp_registered_user.status column
[Control Center - Integrations] Display icon if FIDO2 pairing no longer exists on Azure
[Control Center - Integrations] Integrations error can introduce infinite loop of audit calls
[Control Center - Integrations] User Management - Display icon if FIDO2 pairing no longer exists on Azure
Bug Fixes:
- [Control Center - Integrations] Azure "Go To Setup" Guide links are not accurate
- [Control Center - Integrations] Delete user that is "Paired with Azure" does not delete the FIDO2 credential from Azure
- [Control Center; Platform - Keycloak] User Management - Keycloak needs to leverage machineUserPrincipalName not machineUserName in order to support removal of WHfB
[Control Center - Integrations; Platform - Keycloak]Keycloak Authenticator Refactoring - One Login new integration
- [Control Center] Update all authenticators to allow ALTERNATIVE flow with graceful termination/retry ability
- [Platform - Keycloak] Manual flow to prove that the new Azure and Push authenticators work
- [Platform - Keycloak] Manual flow to prove that the new Azure, Push and FIDO2 authenticators work
- [Platform - Keycloak] FIDO2 login module
- [Platform - Keycloak] Push login module
- [Platform - Keycloak] QR fallback module
- [Platform - Keycloak] QR login module

Enhancements

[All HYPR] Remove Sensory Face and Voice frameworks from the project
[API] Cleanup APIs for multi-iDP support
[Control Center] Add authenticatorDisplayName field to FIDO2RegisteredUser
[Control Center] Add Policy ID to Event structure
[Control Center] Adding Policy Evaluation logging and Audit Trail Event
[Control Center] FIDO2: Origin verification
[Control Center] FIDO2: Update core model to reflect required fields
[Control Center] Update processing of FIDO2 data to be in addtionalDetails
[Control Center - Integrations; Mobile App for iOS] FIDO2 Mobile Authenticator - Audit Events : 'credentialID', 'FIDO2Username', 'rpID' are missing in the 'additionalDetails' section in Datadog logs
[Control Center - Integrations] ADFS Plugin v2: Integrate HTML authentication pieces with ADFS backend
[Control Center - Integrations] Client-side Okta credential validation
[Control Center - Integrations] Event Hooks: OAuth authentication parameters have invalid schemas
[Control Center - Integrations] OneLogin: Allow to read users without email but don't allow to register them
[Mobile App for Android] Abilityt to parse a QR code with deeplink embedded directly from Mobile App scan
[Mobile App for Android] Enhance PIN protection
[Mobile App for Android] Update FIDO2 Data to be in addtionalDetails
[Mobile App for iOS] Allow the SDK consumers to add their own rules to the new PIN UI
[Mobile App for iOS] Being able to parse a QR code with deeplink embedded directly from HYPR Mobile App scan
[Partner Development] FIDO Alliance special login UI
[Passwordless for Windows] Allow in-place upgrades to new builds of the same HYPR Passwordless product version
[Passwordless for Windows] Move websocket ping/pong logging to TRACE level
[Platform] Update ui-component-library with deploy/publish instructions in README
[Platform] Wire up AWS cluster config endpoint awareness to lettuce
[SDK - Extensions] Add proxy support to the HYPR PAM module

Bug Fixes

[API] Fixed: Perform session validation on devices list
[Control Center] Fixed: Authentication and text do not show correct values in the UI
[Control Center] Fixed: Can't trashcan last device on user management table
[Control Center] Fixed: Device Manager v2 breaks rendering on the legacy Device Manager page
[Control Center - Integrations] Fixed: Azure: User is not removed from Keycloak when deleted from Control Center
[Control Center - Integrations] Fixed: Azure Native: User is added to 'Paired with HYPR' AND 'Paired with Azure' after pairing device with HYPR Passwordless
[Control Center - Integrations] Fixed: Cannot add a second device to an integration
[Control Center - Integrations] Fixed: Okta username with plus sign cannot register
[Control Center - Integrations] Fixed: RADIUS: Update lack of valid local configuration to FATAL start and log accordingly
[Control Center - Integrations] Fixed: Users cannot access devices in DM when accessed via Okta portal
[Control Center - Integrations] Fixed: Users do not appear in 'Paired with HYPR' table if a user already exists in the 'Paired with Azure' group
[Control Center - Integrations] Fixed: Web domain is not displayed on Paired with Azure list in Control Center
[Mobile App - Both] Fixed: Authentication cancels when Policy set to PIN + Native authenticator and PIN complexity FF is set to true
[Mobile App for Android] Fixed: Issue refreshing token QR authentication coming from the camera app
[Mobile App for iOS] Fixed: Unable to parse a QR code with deeplink embedded directly from HYPR Mobile App scan with fresh install app unless subsequent registration flow
[Passwordless for Windows] Fixed: AccessViolationException in Native.YubiGetModel()
[Passwordless for Windows] Fixed: HYPR Passwordless may not be able to enroll YubiKey if Windows Hello for Business is enabled
[Platform] Fixed: DurableSchemaRegistry size breaks the build
[Platform - Keycloak] Fixed: Keycloak not creating cookies for username
[Platform - Keycloak] Fixed: Keycloak sends wrong (unused options) request

8.4.1 - Patch 2023-09-27

Bug Fixes

[Mobile App for Android] Fixed: QR authentication: Issue refreshing the token coming from the Camera app

8.5.2 - Patch 2023-09-21

Enhancements

[Partner Development] FIDO Alliance special login UI

8.4.17 - Patch 2023-09-13

Enhancements

[Platform] Liquibase changelog database is not cluster-friendly

8.4.0 - GA 2023-08-09

New Features and Feature Changes

[API] Bulk Export API
- [API] Bulk export API/throttling implementation
[Workforce Access Client - Both] Backoff and Install Token Issues
- [Control Center] Check workstation rpAppId when exchanging the installation token
- [Workforce Access Client - Both] Loosen secure API tokens for Workforce Access Client tokens
- [Workforce Access Client for Windows] Improve network error handling
- [Workforce Access Client for macOS] Implement backoff algorithm for network connection retries
[Control Center; Platform - Keycloak] Passkey UI Updates
- [Control Center] Device Manager UI Updates for Passkey Support
- [Control Center] Login UI Updates for Passkey Support
- [Platform - Keycloak] Onboarding Experience for New Passkey UI
- [Platform - Keycloak] UI Updates for Passkey Support
- [Platform - Keycloak] Update UI for Passkey Experience
HYPR Enterprise Passkey for Azure - Hybrid Domain-joined Support
- [Control Center - Integrations] Update API that the Workforce Access client calls to account for mobile device level full/partial flags
- [Control Center - Integrations] Update code to receive FIDO2 username in Enterprise Passkey Audit Trail Events
- [Control Center - Integrations] Update code to receive RPId in Enterprise Passkey Audit Trail Events
- [Mobile App for Android] Send FIDO2 username in Enterprise Passkey Audit Trail Events
- [Mobile App for Android] Send RPId in Enterprise Passkey Audit Trail Events
- [Mobile App for iOS] Send FIDO2 username in Enterprise Passkey Audit Trail Events
- [Mobile App for iOS] Send RPId in Enterprise Passkey Audit Trail Events
- [Workforce Access Client for Windows] Update Workforce Access Client UX after QRcCode scan to accommodate Enterprise Passkey pairing
- Bug Fixes:
  - [Mobile App for Android] Fixed: Send [Base64URL + MSFT encoding] CredentialId in Enterprise Passkey Audit Trail Events
  - [Mobile App for iOS] Fixed: Send [Base64URL + MSFT encoding] CredentialId in Enterprise Passkey Audit Trail Events
SSL/TLS Pinning enhancements for Mobile/Desktop
- [Control Center] SSL Pinning Updates Implementation
- [Mobile App for Android] SSL Integration Testing
- [Mobile App for Android] SSL Pinning Updates Implementation
- [Mobile App for iOS] SSL Integration Testing
- [Mobile App for iOS] SSL Pinning Updates Implementation
[Control Center - Integrations] Azure: HYPR Enterprise Passkey Enhancements
- [Control Center - Integrations] Azure User Management: Display icon in Pending if devices no longer exist
- [Control Center - Integrations] Azure User Management: Show RP ID when Azure FIDO2 registration takes place
- [Control Center - Integrations] Azure User Management: Update DB with RP ID when Azure FIDO2 registration takes place
- [Control Center - Integrations] Azure User Management: Update the database with FIDO2 username when Azure FIDO2 registration takes place
- [Control Center - Integrations] Azure: "Paired with HYPR" should display the same table info as "Paired with Azure"
- [Control Center - Integrations] Azure: Change domains to web domains
- [Control Center - Integrations] Azure: Create new table for Azure FIDO2 extra details
- [Control Center - Integrations] Azure: Fix queries to use enrolledCredentialId from rp_enrolled_credentials_data
- [Control Center - Integrations] Azure: Include enrolledCredentialId and domainName in User Management queries
- [Control Center - Integrations] Azure: Last active time should be available for mobile devices
- [Control Center - Integrations] Azure: Move enrolledCredentialId from rp_user_device_machine_map to rp_enrolled_credentials_data
- [Control Center - Integrations] Azure: Remove dependency on rp_registered_user.status in the different queries
[Control Center; Mobile App for iOS] Option to Disassociate Passcode from Registration
- [Control Center; Mobile App for iOS] Enablement for Non-passcode Registration
- [Control Center] Enablement for Non-passcode Registration
[Mobile App - Both] Confirm Close on Authentication Request
- [Mobile App - Both] Updated UI on Transaction Summary Screen

Enhancements

[All HYPR] 05-02-2023 CVE Fixes
[All HYPR] CVE-2023-20883
[All HYPR] QR Fallback: Improved browser UX
[API] Endpoint Throttling
[Control Center] Create migration script to enable fallback authenticator by default
[Control Center] Enforce attestation policy
[Control Center] FIDO2 Deterministic user.id
[Control Center] FIDO2: Origin verification
[Control Center] Split FIDO2 configuration into Settings and Policies
[Control Center - Integrations] Add more debug logging to RADIUS server to debug proxy issue
[Control Center - Integrations] ADFS Plugin v2: Integrate HTML registration pieces with ADFS backend
[Control Center - Integrations] Okta: Add username as an alias in HYPR
[Control Center - Integrations] Single Registration integration test
[Control Center; API] Control Center policy API bugfix and PATCH API extension
[Control Center; Errors] Add the kLAErrorAuthenticationFailed error to the list of the errors resulting in the cancelation of the registration on server
[Mobile App for Android] Allow the SDK consumers to add their own rules to the new PIN UI
[Mobile App for Android] Enhance PIN protection
[Mobile App for iOS] Sign the TrustKit library after it gets decoupled for the XCFramework creation
[Mobile App for iOS] Switch active profile based on the machine, when trying to deregister a machine, which doesn't belong to the current active profile
[Mobile App for iOS] Update API token retry logic on QR authentication
[Mobile App for iOS] Upgrade iXGuard on the build machine to the latest to support iOS 17
[Platform - Keycloak] Azure login module
[Platform - Keycloak] Basic Keycloak Upgrade
[Platform - Keycloak; Control Center; Events] Send Brute Force Detection Keycloak Logs / Events to Control Center
[Platform - Keycloak] Fix/Allow setting a custom theme
[Platform - Keycloak] Keycloak not creating cookies for username
[Platform - Keycloak; Control Center - Integrations] Okta Extension: Delete the Keycloak user when we delete the Control Center user
[SDK for Java] Fix Java SDK test suite failures
[Workforce Access Client for macOS] Passwordless Enforcement
[Workforce Access Client for Windows] Azure wording update (Feedback from MSFT)
[Workforce Access Client for Windows] Enrollment Service can't use /rp/wsapi endpoints
[Workforce Access Client for Windows] Move websocket ping/pong logging to TRACE level
[Workforce Access Client for Windows] Remove roaming dependency for making Passwordless User the default tile
[Workforce Access Client for Windows] Stop building Workforce Access client for 32-bit X86

Bug Fixes

[All HYPR] Fixed: Single Registration: Workstation-to-web: Domain user universal principal name (UPN) is used instead of email
[Control Center] Fixed: Magic link is not expired when using firebaseDynamicLinkForHyprApp link
[Control Center - Integrations] Fixed: 500 on integrations; no element of the collection was transformed to a non-null value
[Control Center - Integrations] Fixed: Azure login can fail due to race condition
[Control Center - Integrations] Fixed: Deleting a pairing from HYPR Mobile App doesn't delete from "Paired with Azure" in Control Center
[Control Center - Integrations] Fixed: Multiple IdP Support: Invalid state of RADIUS integration when multiple RADIUS integrations are present
[Control Center - Integrations; Events] Fixed: Some Events are still missing integrationType and integrationProvider
[Events] Fixed: Audit Trail Events are not generated when enabling/disabling FIDO2 Settings
[Events] Fixed: The Audit Trail Event message does not specify the Admin when toggle status updated by a Control Center user
[Mobile App - Both] Fixed: Subsequent Authentication/request is called but not displayed on the authentication screen for the user after first attempt (Tap to Login fails)
[Mobile App for Android] Fixed: Wrong sessionId in Audit Events during failure scenarios
[Platform - Keycloak] Fixed: Keycloak running in an embedded browser gets the QR code cut off
[Platform - Keycloak] Fixed: Keycloak sends wrong (unused options) request
[Platform - Keycloak] Fixed: One time Onboarding Keycloak message is scrollable and not seen unless user explicitly knows
[Platform - Keycloak; Control Center - Integrations] Fixed: After updating integration, QR authentication settings in tenants and Keycloak are no longer aligned
[Workforce Access Client for macOS] Fixed: Login succeeds on paired device but fails on workstation
[Workforce Access Client for Windows] Fixed: Auto upgrade from Workforce Access 8.1.0 to 8.2.2 did not reboot, but it needs to
[Workforce Access Client for Windows] Fixed: Uninstalling Workforce Access 8.2.0 pops up warning about Bonjour service

8.3.0 / 8.2.0 - Patch 2023-08-02

Enhancements

[Control Center - Integrations] Okta: Add username as an alias in HYPR

8.3.1 - Patch 2023-07-28

Enhancements

[All HYPR] Accessibility UI Fixes for Customer
[Control Center] FIDO2: Origin verification
[Control Center] V2 tenant authentication fails due to Invalid Firebase key
[Platform - Keycloak; Events] Send brute force detection Keycloak logs / Events to Control Center

8.4.0 / 7.10.4 - Patch 2023-07-26

Bug Fixes

[Mobile App for Android] User not receiving push notifications and checkForPendingOOB failing to work

8.3.0 - GA 2023-07-12

New Features and Feature Changes

[All HYPR] Fallback Authentication
- [Control Center] Audit Trail Updates for Fallback Authentication
- [Control Center] Enable Fallback Authentication in rpApp
- [Mobile App for Android] Audit Trail Updates for Fallback Authentication
- [Mobile App for Android] Fallback Authentication Flow
- [Mobile App for iOS] Add failed authenticators info to the fallback authentication Audit Trail Event
- [Mobile App for iOS] Audit Trail Updates for Fallback Authentication
- [Mobile App for iOS] Fallback Authentication Flow
[All HYPR] FIDO2 Mobile Authenticator - GA
- [Control Center] Update code to receive CredentialId in Enterprise Passkey Audit Trail Events
- [Mobile App for Android] On FIDO2 Registration, verify RP ID permitted
- [Mobile App for Android] Send CredentialId in Enterprise Passkey Audit Trail Events
- [Mobile App for iOS] On FIDO2 Registration, verify RP ID permitted
- [Mobile App for iOS] Send CredentialId in Enterprise Passkey Audit Trail Events
- [Mobile App for iOS] Send to Support: Logs to include information which can help troubleshoot WIFI issues
- [SDK for FIDO2] Send to Support: Logs to include information which can help troubleshoot WIFI issues
- Bug Fixes:
  - [Mobile App for Android] Fixed: Send [Base64URL] CredentialId in Enterprise Passkey Audit Trail Events
  - [Mobile App for iOS] Fixed: FIDO2: "Username" is missing in the login confirmation screen
  - [SDK for FIDO2; SDK for iOS] Fixed: Credential is missing id and username in UP and UV
[All HYPR] Multiple IdP Environments
- [API] Back End: Fix API calls IdpConfigController
- [API] Back End: Fix API calls IdpUsersController
- [API] Use the fixed API calls and pass rpAppId
- [Control Center - Integrations] Add tests to avoid creating duplicate integration
- [Control Center - Integrations] Allow multiple applications of the same SSO provider to be created
- [Platform] Back End: Add rpAppId to haas-modules GsuiteRedirectRequestDTO
- Bug Fixes:
  - [Control Center - Integrations] Fixed: Delete integration deletes all of the same type
[All HYPR] Passkey Enforcement
- [Control Center] Device Manager: Enforce passkey settings at registration
- [Control Center] Update the Device Name on Device Manager when a multi-device passkey is registered
- [Control Center] Updated FIDO2 configuration
- [Control Center; Platform - Keycloak] Update passkey verbiage
- [Control Center; API] Enable/disable passkeys
- [Platform - Keycloak] UI: Enforce passkey settings at authenticator selection
- [Platform - Keycloak; API; Errors] Enforce passkey settings at authenticator selection
[All HYPR] Single Registration: Workstation-to-web Flow/Migration
- [All HYPR] Single Registration: Internal Pentest
- [All HYPR] Single Registration: Workstation-to-web: Handling multiple workstations for one device or multuiple evices for one workstation
- [Control Center] Single Registration: Implementation of Workstation-to-web Part 2
- [Control Center] Single Registration: Security Review web username validation
- [Mobile App for Android] Single Registration: Implementation Workstation-to-web
- [Mobile App for iOS] Single Registration: Implementation Workstation-to-web
- [Workforce Access Client for macOS] Send email along with domain username during registration flow
- [Workforce Access Client for Windows] Send email along with domain username during registration flow
[API] Add API token to QR login endpoint
- [Mobile App for iOS; API] Include rpAppId in QR code / dynamic link to use API token
[Control Center] FIDO2 Policies
- [Control Center] FIDO2 policies core logic
- [API] FIDO2 policies API
[Control Center; Events; Errors] QR Login Productization
- [Control Center] Set QR login as the default for the ControlCenterAdmin rpApp
- [Control Center] Set QR Login Feature On by default
- [Control Center] Support transaction confirmation for QR code
- [Control Center; Platform - Keycloak] Set Keycloak configuration for QR Login in Control Center UI
[Control Center - Integrations] Azure: FIDO2 Mobile Authenticator GA
- [API] Update mobile endpoint with integration details
- [Control Center] IDP config changes are not being sent right away after being made
- [Control Center] UX: Login Settings update restricted domains behavior
- [Control Center - Integrations] Add Integration: Update Azure icon to reflect latest branding
- [Control Center - Integrations] Back End: User Management for "Pending" Users; enhancements to enrollment
- [Control Center - Integrations] Front End: Delete User Device
- [Control Center - Integrations] Finish the Azure groups and device delete stories
- [Control Center - Integrations] User Enrollment: Paired with Azure Update Azure when Control Center Admin deletes user or device
- [Control Center - Integrations] User Enrollment: Paired with Azure Update Azure when user "trashcans" via mobile device
- [Control Center - Integrations] User Enrollment: Paired with Azure Update Azure when user "trashcans" via workstation client
- [Control Center - Integrations] User Enrollment: Paired with HYPR Update Azure when Control Center Admin deletes user or device
- [Control Center - Integrations] User Enrollment: Paired with HYPR Update Azure when user "Pairs With HYPR" (Pending)
- [Control Center - Integrations] User Enrollment: Paired with HYPR Update Azure when user "Pairs With HYPR" via mobile device
- [Control Center - Integrations] User Enrollment: Paired with HYPR Update Azure when user "trashcans" via mobile device
- [Control Center - Integrations] User Enrollment: Paired with HYPR Update Azure when user "trashcans" via workstation client
- [Control Center - Integrations] User Management for "Paired with HYPR" users
- [Control Center - Integrations] User Management: Update DB with credential id when Azure FIDO2 Registration takes place
- [Control Center - Integrations] UX: Add new FIDO2 enrollment email template
- [Control Center - Integrations] UX: Adding "Pending" Tab and Enroll Users
- [Control Center - Integrations] UX: User Management for "Paired with Azure" users (new table)
- [Control Center - Integrations] UX: User Management for "Pending" Users
- Bug Fixes:
  - [Control Center] Fixed: IDP config changes are not being sent right away after being made
  - [Control Center - Integrations] Fixed: Azure: Trash can delete on mobile device does not remove user from correct Azure group
  - [Control Center - Integrations] Fixed: Azure: User deleted from Pending table in Azure integration is not removed from eligible for pairing group on Azure
  - [Control Center - Integrations] Fixed: Azure: User not added to "HYPR Group (Client Paired With Azure)" when successfully paired with Azure
  - [Control Center - Integrations] Fixed: Azure: User not added to "HYPR Group (Eligible for Pairing)" when sent Enrollment email
  - [Control Center - Integrations] Fixed: Azure: When a Control Center admin deletes a users device they are removed from the Eligible for pairing user group on Azure
  - [Control Center - Integrations] Fixed: Back End: Delete the last User's Device doesn't delete a User and doesn't return it into "Pending" state
  - [Control Center - Integrations; Mobile App - Both] Fixed: Cannot "Pair with HYPR"; QR Code scan fails with 1202600
[Control Center - Integrations] Event Hooks Refactor Into Unique SIEMs
- [Control Center - Integrations] Event Hook: Add enablement for Custom
- [Control Center - Integrations] Event Hook: Add Splunk Cloud Provider field
- [Control Center - Integrations] Event Hook: Clean up Event Hooks from the UI
- [Control Center - Integrations] Event Hook: Create Beta UI for Custom
- [Control Center - Integrations] Event Hook: Create Custom integration tile
- [Control Center - Integrations] Event Hook: Custom Event Hook UI
- [Control Center - Integrations] Event Hook: Prevent 500 errors
- [Control Center - Integrations] Event Hook: Refactor the backend
[Mobile App for iOS] Firebase Token Force Refresh
- [Mobile App for iOS] Request and send new token when value is nil
[Platform] Server/Ops Updates
- [Platform] Slimmed down Control Center container for on-premises customers
- [Platform - Firebase] Firebase SDK upgrade: Convert push functionality to SDK calls
- [Platform - Firebase] Firebase SDK upgrade: Write integration tests covering SDK flow
[Platform] Support for multi-region installations - Phase I
- [Platform] Add conflict avoidance/resolution columns; update existing usage; add Event origin
- [Platform] Dataprop change capture and propagation for update statements
- [Platform] Dataprop changelog and group membership
- [Platform] Handle muti-region out-of-band (OOB) authentication
- [Platform] Handle muti-region workstation authentication
- [Platform] Implement network policies for cell clusters
- [Platform] Review dataprop changelog and group membership
[SDKs for Android and iOS] Mobile Reference App Expansion
- [SDK for Android] AAID Chooser Screen
- [SDK for Android] Progress Spinner Overrides
- [SDK for iOS] AAID Chooser Screen
- [SDK for iOS] Authentication/Transaction Accept screens
- [SDK for iOS] Push Overrides
[Workforce Access Client - Both] Backoff and Installation Token Issues
- [Control Center] Check workstation rpAppId when exchanging install token
- [Workforce Access Client - Both; API] Loosen secure API tokens for Workstation Installation tokens
- [Workforce Access Client for macOS] Send rpAppId when exchanging install token
- [Workforce Access Client for Windows] Send rpAppId when exchanging install token
[Workforce Access Client for Windows] FIDO2 Mobile Authenticator GA
- [Control Center - Integrations] Azure: Provide updates required for client UX for HYPR pairing (Azure domain-joined) - I
- [Control Center - Integrations; API] Update device query endpoint
- [Workforce Access Client for Windows] Complete Merge: Update client UX for HYPR pairing (Azure domain-joined)
- [Workforce Access Client for Windows] Update client UX for HYPR pairing (Azure domain-joined) - II
- Bug Fixes
  - [Workforce Access Client for Windows] Fixed: FIDO2: Spelling errors observed on the pairing screens

Enhancements

[Control Center] Create migration script to enable fallback authenticator feature by default
[Control Center] FIDO2 Settings: Origin verification
[Control Center] QR Fallback issues encountered during internal testing
[Control Center] Update FIDO2 metadata periodically
[Control Center] Update verbiage for the Require User Presence description
[Control Center; API] Update existing API with rpAppId for QR authentication
[Control Center - Integrations] Create a facade service with caching to handle integrations
[Mobile App for Android] If the HYPR Mobile App is backgrounded during registration, it cancels and throws an error
[Mobile App for Android] Issue with Chrome 112 using deeplinks
[Mobile App for Android] No paired devices showing after long phone idle state
[Mobile App for Android] Single Registration: Remove checks for domain-joined machine
[Mobile App for Android] Use the rpAppId for QR authentication when it is available
[Mobile App for iOS] Allow HYPR Mobile App to bypass the Firebase dynamic link validity check
[Platform - Keycloak] Keycloak is not creating cookies for the username
[Platform - Keycloak] Merge customer inline changes into master
[Platform] Spring CVE Fixes
[SDK for Android] Add text to identify "Limited APK" along with the version text
[Workforce Access Client for macOS] Extend logging for the keychain failure to help diagnose intermittent authentication failures
[Workforce Access Client for macOS] Passwordless Enforcement
[Workforce Access Client for macOS] Send Audit messages for security key registration and authentication
[Workforce Access Client for Windows] Accept any type of Windows credential for user presence validation
[Workforce Access Client for Windows] Investigate multi-user SSO fail
[Workforce Access Client for Windows] Remove Microsoft C/C++ Runtime from the client installer

Bug Fixes

[All HYPR] Fixed: Asynchronous registration fails when default QR login settings is enabled and Push configuration disabled vs registration succeeds
[Control Center] Fixed: Implement ownership validation for Lock requests
[Control Center] Fixed: User can type in a username into HYPR Control Center login, and then login with a passkey that has a different username
[Control Center - Integrations; Events] Fixed: Events missing IntegrationType and IntegrationProvider
[Control Center - Integrations] Fixed: Azure Native Login: Exception while trying to pair a device with Azure
[Control Center - Integrations] Fixed: Azure: Adding a space at the end of a username prompt us to enter password for already registered users
[Control Center - Integrations] Fixed: Azure: Can't update integration
[Control Center - Integrations] Fixed: Azure: Cannot save restricted domains when we have two Azure integrations in place
[Control Center - Integrations] Fixed: Azure: Groups don't get deleted when add integration fails due to insufficient privileges around creating a conditional access policy
[Control Center - Integrations] Fixed: Azure: Incorrect handling of missing field in Azure custom JSON data in 8.3 and above
[Control Center - Integrations] Fixed: Google Workspace: Cannot not add integration on 8.3
[Control Center - Integrations] Fixed: Integration Config cache populates duplicate integrations
[Control Center - Integrations] Fixed: Okta: It is possible to Add integration as Control Center admin user
[Control Center - Integrations] Fixed: Okta: Server error after adding integration
[Control Center - Integrations] Fixed: User Enrollment: User remains in enrolled list, if last deleted device is a security key or computer
[Mobile App - Both] Fixed: Mobile device not sending deviceId during 2nd registration
[Mobile App for Android] Fixed: App crashes on tapping "Login" button during Device Manager authentication
[Mobile App for iOS] Fixed: App crashes during FIDO2 authentication
[Mobile App for iOS] Fixed: App crashes when cancel Chooser/ registration that is timed out
[Platform - Keycloak] Fixed: "Insert your security key..." message displays when user selects 'smartphone' for Keycloak+Okta login
[Platform] Fixed: NullPointerException when FIDO2 Event fails
[Platform] Fixed: Multi-pod deployment issues for the IDP cache
[SDK for iOS] Fixed: Investigate and fix a crash when more than one cancelation is called for the same registration operation by the SDK consumer
[Workforce Access Client for macOS; Mobile App - Both] Fixed: HYPR App Tap to Login fails if an enrolled security key is plugged in
[Workforce Access Client for Windows] Fixed: "Contact Support" doesn't report latest error code and/or message in email
[Workforce Access Client for Windows] Fixed: "Contact Support" generates empty error fields in the email when there's no error; also "occurred" is misspelled
[Workforce Access Client for Windows] Fixed: Client may not be able to enroll YubiKey if Windows Hello for Business is enabled
[Workforce Access Client for Windows] Fixed: HyprCredProvider needs MSVC runtime DLL's that aren't included with Windows
[Workforce Access Client for Windows] Fixed: Incorrect log message
[Workforce Access Client for Windows] Fixed: Only send AzureAD user name to RP for FIDO2 pairing
[Workforce Access Client for Windows] Fixed: Registration with user presence enabled, fails on first incorrect password entry
[Workforce Access Client for Windows] Fixed: Single Registration: Workstation-to-web: Re-pairing with the Workforce Access Client after deleting users from Control Center doesn't work
[Workforce Access Client for Windows] Fixed: Single Registration: Workstation-to-web: UPN of domain user gets used instead of email
[Workforce Access Client for Windows] Fixed: UX for HYPR Pairing (Azure Domain Joined) is still not updated UI reflecting pairing completed

8.2.8 - Patch 2023-07-03

Enhancements

[Control Center] Check the workstation rpAppId when exchanging the installation token
[Workforce Access Client - Both; API] Loosen secure API tokens for Workstation Installation tokens

8.2.2 - Patch 2023-06-02

Enhancements

[Control Center - Integrations] Only send Azure AD username to the RP Application for FIDO2 pairing

8.1.25 - Patch 2023-06-02

Enhancements

[Workforce Access Client - Both; API] Loosen secure API tokens for Workforce Access Installation tokens

8.2.1 - Patch 2023-05-15

Enhancements

[Workforce Access Client for macOS] Passwordless Enforcement

Bug Fixes

[Events] Fixed: Issue with HYPR Event noise

8.2.0 - GA 2023-05-10

New Features and Feature Changes

[All HYPR] Server/Ops Updates
- [Platform - Firebase] Firebase SDK Upgrade: New UI for adding SDK configuration
- [Platform - Firebase] Firebase SDK Upgrade: Lift v2 code; extend functionality; enable v1 path
[Control Center; Workforce Access Client for Windows] Automatic updates to v2 migrated customers
- [Workforce Access Client for Windows] Remove HYPR-as-a-service check in clients for Auto-upgrade feature
[Control Center - Integrations] Azure: FIDO2 Mobile Authenticator - Early Access - Bug Fixes
- [Control Center - Integrations] Fixed: 'Add Integration' HYPR authentication policy requests a PIN when pairing a QR code
- [Control Center - Integrations] Fixed: Azure: User added to wrong Azure group when "Paired with HYPR"
- [Control Center - Integrations; API] Fixed: Azure API response for enable/disable doesn't populate the capability field
[Control Center - Integrations] Azure: FIDO2 Mobile Authenticator GA
- [Control Center - Integrations] Azure User Enrollment: Update Azure when user "Paired with Azure" via mobile device
- [Control Center - Integrations] Update 'Add Integration' description to reflect Enterprise Passkey naming convention
- [Control Center - Integrations] User Management: HYPR DB needs to store FIDO2 credential ID on registration
[Control Center - Integrations] Event Hooks Refactor Into Unique SIEMs
- Control Center - Integrations] Event Hooks: Change integration UI SIEMs to Event Hooks
- Control Center - Integrations] Event Hooks: Add Feature enablement for Splunk and DataDog Event Management integration
- Control Center - Integrations] Event Hooks: Create integration UI for Splunk and Datadog
- Control Center - Integrations] Event Hooks: Create Beta UI for Splunk and DataDog
- Control Center - Integrations] Event Hooks: Event Mgmt Event Hook Table and tab
- Control Center - Integrations] Event Hooks: Event Mgmt: Delete Event Hook
- Control Center - Integrations] Event Hooks: Event Mgmt: Update integrations for Splunk, DataDog
- Control Center - Integrations; API] API to list Event Hooks by integration type
[Mobile App - Both] Invalidate registration following new device biometric
- [Mobile App for iOS] Implement invalidation of biometrics
[Workforce Access Client for Windows] Security Keys certificate renewal manual trigger
- [Workforce Access Client for Windows] Allow user to manually force certificate renewal
[Workforce Access Client for Windows] WebAuthn: Passkey Detection
- [Control Center] FIDO2: Make AssertionResultService work with discoverable credentials
- [Control Center] FIDO2: Attestation Level 3 validation

Enhancements

[API; Errors] Separate the user cancel errors from the failures leading to the call of the sever cancel APIs
[Control Center] Passkey Enforcement: Update empty AAGUID device name
[Control Center - Integrations] Removing validation for keyAgreementPublicKey and keyAgreementPublicKeyAUTH when FIDO2 Mobile Authenticatoris enabled
[Control Center - Integrations] ADFS Plugin V2: HTML Templates
[Control Center - Integrations] Removing validation for signingCert when FIDO2 Mobile Authenticator is enabled
[Mobile App for Android] Issue with message showing up when not needed on Android
[Mobile App for Android] Request and Send New Token when Value is NIL
[Mobile App for iOS] Adding feature enablement for iOS invalidation upon a new biometric registration
[Mobile App for iOS] Allow user to pick destination for log submission
[Mobile App for iOS] Implement potential application slowness fix reported in Zendesk
[Mobile App for iOS] Updated authentication flow for in-app QR scan
[Platform - AWS] AWS WAF rule breaks img upload test
[Platform - Firebase] Firebase SDK Upgrade: Liquibase Java migration script
[Platform - Keycloak] Keycloak not creating cookies for username
[Platform - Keycloak] POC for one simple use case
[Workforce Access Client for Windows] Customization of "Contact Support" behavior - Customer request
[Workforce Access Client for Windows] Desktop SSO "success" notification popup should close itself after a timeout
[Workforce Access Client for Windows] Enable Workforce Access Client for RDP remote sessions
[Workforce Access Client for Windows] Log information from user login certificate

Bug Fixes

[Control Center - Integration] Fixed: Ping DaVinci: Redirect URL list accepts periods instead of commas to separate URLs
[Control Center - Integration] Fixed: User enrollment drawer: Can't send invite to personal email
[Control Center - Integrations' Mobile App for iOS] Fixed: Unable to complete Azure pairing with iOS
[Control Center] Fixed: Wrong push notifcation copy when certificate has been processed
[Mobile App for Android] Fixed: ArrayIndexOutOfBoundsException on permission check; notification permission checker fixed
[Mobile App for Android] Fixed: Crash on A53 during enrolment
[Mobile App for Android] Fixed: Deletion process is corrupted and causes unwanted unpairing of Workstation and Web accounts when the server has a pending authentication request
[Mobile App for Android] Fixed: QR Fallback activation code entry 'Submit' button is inactive
[Mobile App for iOS] Fixed: Email picker destination not available when log submission is disabled and multiple accounts paired
[Platform - Keycloak] Fixed: Keycloak authentication with 'UV=required' succeeds in Safari when the security key is not protected with a PIN
[Workforce Access Client - Both] Fixed: Incorrect WORKSTATION_CERTIFICATE_REQUESTED Event in the flow
[Workforce Access Client for macOS] Fixed: Client crashes when requesting certificate from AD
[Workforce Access Client for macOS] Fixed: Registration fails when Cert based authentication and User presence is disabled
[Workforce Access Client for Windows] Fixed: FIDO2 pairing disappears
[Workforce Accesss Client for macOS] Fixed: QR Fallback: macOS doesn't show proper error screen when the feature is disabled

8.1.0 - GA 2023-03-29

New Features and Feature Changes

[All HYPR] Custom FIDO2 WebAuthn Parameters
- [API] Enforce WebAuthn parameters in end-user flows
- [Control Center] Updated Device Manager flow based on custom WebAuthn parameters
- [Control Center] New FIDO2 WebAuthn settings
- [Platform - Keycloak] Updated flow based on custom WebAuthn parameters
[All HYPR] Fallback for QR Scan (Web)
- [API] Adjust QR Fallback payload to specify 'qrFallbackMobileURL'
- [Control Center; API] New endpoint to retrieve QR code payload
- [Control Center; Events] Add Audit Events for QR Fallback
- [Control Center] Configure QR Fallback options
- [Control Center] Remove "Begin Pairing" and auto-refresh QR code in Device Manager
- [Control Center] Update QR fallback server setting to True by default
- [Control Center] Update QR Payload Response to Include Short URL
- [Device Manager] Display QR Fallback Information for Web Registration
- [Mobile App for Android] Add Manual Camera Access Text to Fallback Screen
- [Mobile App for Android] Adjust QR Fallback Payload to Specify 'qrFallbackMobileURL'
- [Mobile App for Android] Authenticate using device with QR Fallback
- [Mobile App for Android] No Camera Access Fallback QR Flow
- [Mobile App for iOS] Adjust QR Fallback Payload to Specify 'qrFallbackMobileURL'
- [Mobile App for iOS] Register Device with QR Fallback
- [Mobile App for iOS] Authenticate using Device with QR Fallback
- [Mobile App for iOS] No Camera Access Fallback QR Flow
- [Platform - Keycloak] Desktop: display QR Fallback information for web authentication
- [Platform - Keycloak] Extend QR Fallback to Keycloak HYPR registrator
- [Platform - Keycloak] Mobile: Display Dynamic Link fallback information for authentication
- [SDK for Java] Adjust current QR functions to incorporate fallback functionality
- [SDK for Java] Adjust Java SDK for respective QR Fallback response and request
[All HYPR] Security Improvements
- [API] Safeguard against missed input validation
- [Errors] Reduce details in error msgs
- [Errors] Reduce details in error msgs
- [Sample Web App] Fixed: Unauthenticated access to various APIs
[Control Center] FIDO2/WebAuthn: Passkey Detection
- [Control Center] FIDO2: Extend model with Credential Backup State
- [Control Center] FIDO2: Implement Credential Properties extension
- [Control Center] FIDO2: Persist transport value on registration
[Control Center - Integrations] Azure: FIDO2 Mobile Authenticator - Early Access
- [Control Center] Back End: Delete User Device
- [Control Center] Back End: Native Azure Login Experience Go Live should not federate a domain
- [Control Center] Back End: Move user from one status to another
- [Control Center] UX: Hide "Enroll Users" and "Pending"
- [Control Center; API] Back End: Azure backend API changes to user Enrollment
- [Control Center; API] Back End: User Management API changes
- [Control Center - Integrations] Back End: Add support in the Workforce Access Client Download (via Onboarding) to support new hypr.json config values
- [Control Center - Integrations] Back End: Feature should be enabled
- [Control Center - Integrations] Back End: Create new Status column in rp_registered_user
- [Control Center - Integrations] Back End: Azure changes to Add Integration
- [Control Center - Integrations] UX: Integration changes to status Enable/Disable
- [Control Center - Integrations] Back End: Native Azure Login Experience Login Settings tab: restrict domains
- [Control Center - Integrations; API] Back End: Create get integration configuration API
- [Control Center - Integrations; Events] Back End: Enable FIDO2 Mobile Authenticator Events
- [Control Center - Integrations; Events] Back End: FIDO2 Mobile Events for Deregistration and Reset
- [Control Center - Integrations; Events] Back End: Fix Event integration type
- Bug Fixes:
  - [Control Center - Integrations] Fixed: Azure: rp_registered_user status not updated after pairing device to the Workforce Access client
  - [Control Center - Integrations] Fixed: Azure: rp_registered_user status column gets updated from PARTIAL to FULL based on incorrect Event
  - [Control Center - Integrations] Fixed: Azure: user status not in the response when calling getUser on the registered user
  - [Workforce Access Client] Fixed: Downloaded client hypr.json contains install token scoped to default workstation rpApp
  - [Workforce Access Client] Fixed: User unable to successfully Pair with HYPR when QR Code scan; Keycloak data missing
[Control Center - Integrations] FIDO2 Mobile Authenticator Bug Fixes
- [Mobile App for Android] Fixed: My Security Key not displaying login history
- [Mobile App for Android] Fixed: FIDO2 authentication User Presence denial shows a registration failure message
[Control Center - Integrations] User Enrollment Drawer Enhancements
- [Control Center - Integrations] User Management: When Pending/Enrolled, show an option for 'personal email' or 'sync email'
- [Control Center - Integrations] UX Updates To "Pending Go-Live" Page
- [Control Center - Integrations] Add "Send Manually" Tab
- [Control Center - Integrations] Add personal email capabilities
[Control Center - Integrations] Web Hooks Refactor Into Unique SIEMs
- [Control Center - Integrations] Event Hooks: Fix Splunk .SVG file in the integration tile
- [Control Center - Integrations] Event Hooks: Create DataDog integration tile
[Control Center - Integrations; Mobile App for iOS] Include RADIUS Client Name in authentication confirmation
- [Control Center] Add Note in Control Center about Friendly Name in authentication confirmation
- [Control Center - Integrations; Mobile App for iOS] Display RADIUS Client Name in authentication request
- [Control Center - Integrations; SDKs for Android, FIDO2, iOS; Workforce Access Client for Windows] FIDO2 Mobile Authenticator - Early Access
- [Control Center] Implement FIDO2 Workforce Access Client pairing changes
- [Mobile App for Android] Send FIDO2 Mobile Authenticator Events
- [Mobile App for Android] QR Code Scan for HYPR Pairing (Device Binding)
- [Mobile App for Android] Display User ID (email) after successfully pairing with HYPR
- [Mobile App for Android] Check server configuration prior to Azure pairing/authentication
- [Mobile App for Android] Update User ID (email) after successfully pairing with Azure
- [Mobile App for Android] New registration type option "My Security Keys"
- [Mobile App for Android] FIDO2 Integration updates
- [Mobile App for iOS] Send FIDO2 Mobile Authenticator Events
- [Mobile App for iOS] QR Code Scan for HYPR Pairing (Device Binding)
- [Mobile App for iOS] Display User ID (email) after successfully pairing with HYPR
- [Mobile App for iOS] Check server configuration prior to Azure pairing/authentication
- [Mobile App for iOS] New registration type option "My Security Keys"
- [Mobile App for iOS] FIDO2 Integration updates
- [SDK for FIDO2] FIDO2 IntegrationuUpdates
- [Workforce Access Client for Windows] Complete merge of Windows FIDO2 integration into the Workforce Access Client repo
- [Workforce Access Client for Windows; Mobile App for Android]
- Bug Fixes:
  - [Workforce Access Client for Windows] Fixed: FIDO2 - Unlock Azure account fails
  - [Mobile App for iOS] Fixed: FIDO2: Unable to complete Azure pairing
[Workforce Access Client for macOS] Security Keys Support for macOS
- [Workforce Access Client for macOS] Fixed: Error messages are not displayed for security key PIN field validations
- [Workforce Access Client for macOS] Unpair Security Key shows "This will unpair your smartphone" message
- [Workforce Access Client for macOS] Integrate Yubico libraries
- [Workforce Access Client for macOS] Update UI for security keys
[Workforce Access Client for Windows] FIDO2 Mobile Authenticator Workstation Unlock - Early Access
- [Control Center; Events] Events for QR Code Pairing
[Workforce Access Client for Windows] Non-Exportable Private Keys / Certificate Template for Security Keys
- [Workforce Access Client for Windows] Generate a private key on YubiKey
- [Workforce Access Client for Windows] Option for a certificate template with a non-exportable private key
[Workforce Access Client for Windows] QR Fallback Bug Fixes
- [Workforce Access Client for Windows] Fixed: QR Fallback: Windows doesn't show proper error screen when the feature is disabled
- [Workforce Access Client for Windows] Fixed: QR Fallback: Server doesn't return a proper error code when when the feature is disabled
- [Workforce Access Client for Windows] Fixed: QR Fallback: Registration fails on the latest 8.1 build
- [Workforce Access Client for Windows] Fixed: QR Fallback: "Pair Manually" link does not work after clicking on Begin Pairing button
- [Workforce Access Client for Windows] Fixed: QR Fallback: Clicking on “Back to QR scan” has no response and doesn’t navigate back to QR scan screen
- [Workforce Access Client for Windows] Fixed: QR Fallback: If this feature is disabled, the standard QR registration flow fails until service is restarted
- [Workforce Access Client for Windows] Fixed: QR Fallback: Information for Roaming Authentication

Enhancements

[All HYPR] Global user: Java user model changes I; migrating to a new data structure
[Control Center] Add "Desktop SSO" capability to "Login Settings"
[Control Center] Error in client config causes a spike in hosted tenant error logs
[Control Center] FIDO2: Record transport on WebAuthn operations
[Control Center] Invalidate session when modifying user roles
[Control Center] Remove deprecated feature
[Control Center] Remove obsolete "Domain Joined Users" option in Control Center configuration
[Control Center; API] Add API token to QR login endpoint
[Control Center; Events] Audit Trail Fields with unknown values in Event logs should always be set to a blank/empty string
[Control Center - Integrations] FIDO2 Mobile Authenticator - Limit discovery to only registered devices
[Control Center - Integrations] Fix links to documentation in our integrations
[Control Center - Integrations] RADIUS Configuration
[Control Center - Integrations] RADIUS Server Management
[Control Center - Integrations] Removing validation for keyAgreementPublicKey and keyAgreementPublicKeyAUTH when FIDO2 Mobile Authenticator is enabled
[Control Center - Integrations] Removing validation for loginCert when FIDO2 Mobile Authenticator is enabled
[Control Center - Integrations] Removing validation for signingCert when FIDO2 Mobile Authenticator is enabled
[Control Center - Integrations] Update mouse-over on "Current Integrations" -> "Options" to say "Login Settings"
[Mobile App - Both] Support button label
[Mobile App for Android; SDK for Android] Notifications on Android 13 and target 33
[Platform - CVE Fixes] CVE-2022-3064, CVE-2022-45143
[Platform - CVE Fixes] CVE-2023-1370: Fix for json-smart lib and nimbus-jose-jwt lib
[Platform - Keycloak] Cookies are not being created for the username
[Platform - Keycloak] Create Enable Keycloak Modules feature
[Platform - Redis] Clear error handling for Enterprise Redis
[Platform] Support for multi-region installations
[Sample Web App] Allow options for initial registration
[Sample Web App] Update public docs
[SDK for Android] Allow background to cancel registration
[SDK for Android] Manual Registration (QR Fallback) button visibility config
[Workforce Access Client for macOS] Mitigate privilege escalation in HyprOneService
[Workforce Access Client for macOS] Support for macOS Ventura
[Workforce Access Client for Windows] Import latest ykpiv code from Yubico

Bug Fixes

[Control Center] Fixed: Audit messages from workstation are being mangled
[Control Center] Fixed: FIDO2 Settings UI updates
[Control Center] Fixed: Not possible to login to Control Center with a FIDO2 device
[Events] Fixed: Remove value from ExtensionConfigAttribute.toString() for sensitive or redacted attributes
[Control Center - Integrations] Fixed: Azure: Domain gets federated on error
[Control Center - Integrations] Fixed: Google Workspace: Can't create integration with name that includes spaces
[Control Center - Integrations] Fixed: Google Workspace: SSO info not cleared from Google Workspace upon deleting integration
[Control Center - Integrations] Fixed: OneLogin: User loses HYPR roll when integration gets disabled, if they were added when integration was live
[Control Center - Integrations] Fixed: Ping DaVinci: Fix link/text for Support documentation
[Control Center - Integrations] Fixed: Ping DaVinci: Protocol itself needs validation
[Control Center - Integrations] Fixed: QR authentication fails after updating integration
[Control Center - Integrations; Events] Fixed: Some Events are missing integrationType and integrationProvider information
[Mobile App - Both] Fixed: Browser log in into Device Manager succeeds on but the browser never accesses Device Manager
[Mobile App for Android] Fixed: Android app must set device ID for FIDO2 authenticator
[Mobile App for Android] Fixed: ArrayIndexOutOfBoundsException on permission check; notification permission checker fixed
[Mobile App for Android] Fixed: Offline PIN fails to display after successful authentication for the paired workstation
[Mobile App for iOS] Fixed: rpApp displays instead of RADIUS Client Name in Authentication Request
[Platform - Keycloak] Fixed: Bug in keycloak does not remember user from previous authentication
[Platform - Keycloak] Fixed: Realm name limitation is 36 characters; we need to verify that that we build it correctly
[Platform - Keycloak] Fixed: UI issue on the Web browser and Mobile browser login pages
[Sample Web App] Fixed: Implement CSRF protections
[Sample Web App] Fixed: Unable to login with appless QR code after logging out of the sample app
[Sample Web App] Fixed: Update jQuery version
[Workforce Access Client for macOS] Fixed: Login dialog doesn't disappear when using TouchID
[Workforce Access Client for Windows] Fixed: FIDO2 pairing disappears
[Workforce Access Client for Windows] Fixed: Import latest ykpiv code from Yubico
[Workforce Access Client for Windows] Fixed: Windows Update breaks the user presence check during registration

11.3.6 - Patch 2026-09-23​

Features & Enhancements​

Bug Fixes​

Known Issues​

11.3.5 - Patch 2026-09-17​

Features & Enhancements​

Bug Fixes​

11.3.4 - Patch 2026-09-04​

Features & Enhancements​

Known Issues​

11.3.3 - Patch 2026-08-18​

Bug Fixes​

11.3.2 - Patch 2026-08-01​

Bug Fixes​

11.3.1 - Patch 2026-07-24​

Features & Enhancements​

Bug Fixes​

11.3.0 - GA 2026-06-24​

Features & Enhancements​

Bug Fixes​

Known Issues​

11.1.2 - Patch 2026-05-15​

Bug Fixes​

Known Issues​

11.1.1 - Patch 2026-04-22​

Bug Fixes​

Known Issues​

11.1.0 - GA 2026-03-27​

Features & Enhancements​

Bug Fixes​

Known Issues​

10.7.1 - GA 2026-01-07​

Features & Enhancements​

Bug Fixes​

10.5.0 - GA 2025-09-24​

Features & Enhancements​

Bug Fixes​

10.3.0 - GA 2025-06-25​

Enhancements​

Bug Fixes​

10.0.0 - GA 2025-02-12​

Enhancements​

Bug Fixes​

9.7.2 - GA 2025-02-07​

Enhancements​

Bug Fixes​

9.7.1 - GA 2025-01-07​

Enhancements​

Bug Fixes​

9.7.0 - GA 2024-12-11​

New Features and Feature Changes​

Enhancements​

Bug Fixes​

9.5.3 - Patch 2024-11-18​

Enhancements​

Bug Fixes​

9.5.2 - Patch 2024-11-01​

New Features and Feature Changes​

Enhancements​

Bug Fixes​

9.6.0 - GA 2024-10-01​

New Features and Feature Changes​

Enhancements​

Bug Fixes​

9.5.0 - GA 2024-09-12​

New Features and Feature Changes​

Enhancements​

Bug Fixes​

9.3.2 - Patch 2024-08-23​

Enhancements​

Bug Fixes​

9.3.1 - Patch 2024-08-07​

Enhancements​

Bug Fixes​

9.4.0 - GA 2024-07-24​

New Features and Feature Changes​

Enhancements​

Bug Fixes​

9.3.0 - GA 2024-07-17​

New Features and Feature Changes​

11.3.6 - Patch 2026-09-23

Features & Enhancements

Bug Fixes

Known Issues

11.3.5 - Patch 2026-09-17

Features & Enhancements

Bug Fixes

11.3.4 - Patch 2026-09-04

Features & Enhancements

Known Issues

11.3.3 - Patch 2026-08-18

Bug Fixes

11.3.2 - Patch 2026-08-01

Bug Fixes

11.3.1 - Patch 2026-07-24

Features & Enhancements

Bug Fixes

11.3.0 - GA 2026-06-24

Features & Enhancements

Bug Fixes

Known Issues

11.1.2 - Patch 2026-05-15

Bug Fixes

Known Issues

11.1.1 - Patch 2026-04-22

Bug Fixes

Known Issues

11.1.0 - GA 2026-03-27

Features & Enhancements

Bug Fixes

Known Issues

10.7.1 - GA 2026-01-07

Features & Enhancements

Bug Fixes

10.5.0 - GA 2025-09-24

Features & Enhancements

Bug Fixes

10.3.0 - GA 2025-06-25

Enhancements

Bug Fixes

10.0.0 - GA 2025-02-12

Enhancements

Bug Fixes

9.7.2 - GA 2025-02-07

Enhancements

Bug Fixes

9.7.1 - GA 2025-01-07

Enhancements

Bug Fixes

9.7.0 - GA 2024-12-11

New Features and Feature Changes

Enhancements

Bug Fixes

9.5.3 - Patch 2024-11-18

Enhancements

Bug Fixes

9.5.2 - Patch 2024-11-01

New Features and Feature Changes

Enhancements

Bug Fixes

9.6.0 - GA 2024-10-01

New Features and Feature Changes

Enhancements

Bug Fixes

9.5.0 - GA 2024-09-12

New Features and Feature Changes

Enhancements

Bug Fixes

9.3.2 - Patch 2024-08-23

Enhancements

Bug Fixes

9.3.1 - Patch 2024-08-07

Enhancements

Bug Fixes

9.4.0 - GA 2024-07-24

New Features and Feature Changes

Enhancements

Bug Fixes

9.3.0 - GA 2024-07-17

New Features and Feature Changes