<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Aptos;
panose-1:2 11 0 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:12.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#467886;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Aptos",sans-serif;
color:windowtext;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
.MsoChpDefault
{mso-style-type:export-only;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-GB" link="#467886" vlink="#96607D" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#212121">The Shibboleth Project has released version 1.4.2 of the WebAuthn authentication plugin.<o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(33, 33, 33);font-variant-caps: normal;orphans: 2;text-align:start;widows: 2;-webkit-text-stroke-width: 0px;text-decoration-line: none;text-decoration-thickness: auto;text-decoration-style: solid;word-spacing:0px">
<span style="color:#212121"> <o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(33, 33, 33);font-variant-caps: normal;orphans: 2;text-align:start;widows: 2;-webkit-text-stroke-width: 0px;text-decoration-line: none;text-decoration-thickness: auto;text-decoration-style: solid;word-spacing:0px">
<span style="color:#212121">This patch release primarily updates the Yubico WebAuthn libraries to version 2.9.0, including a fix for a FIDO metadata parsing issue.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#212121"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#212121">Version 2.9.0 also resolves a regression we identified and reported in later releases of the Yubico library, which led to a high-severity impersonation vulnerability [1]. We were not affected by this issue and
intentionally deferred upgrading until a fix was available.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#212121"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#212121">For full details, please refer to the release notes [2].<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#212121"><br>
— Phil Smart, on behalf of the team<o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(33, 33, 33);font-variant-caps: normal;orphans: 2;text-align:start;widows: 2;-webkit-text-stroke-width: 0px;text-decoration-line: none;text-decoration-thickness: auto;text-decoration-style: solid;word-spacing:0px">
<span style="color:#212121"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#212121">[1] <a href="https://www.yubico.com/support/security-advisories/ysa-2026-02/">
https://www.yubico.com/support/security-advisories/ysa-2026-02/</a><br>
[2]<span class="apple-converted-space"> </span><a href="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3394928781/WebAuthnReleaseNotes" title="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3394928781/WebAuthnReleaseNotes"><span style="color:#96607D">https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3394928781/WebAuthnReleaseNotes</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<mc type="body"><font size="1"><font face="Corbel"><br>
<p>Jisc is a registered charity (in England and Wales under charity number 1149740; in Scotland under charity number SC053607) and a company limited by guarantee registered in England under company number 05747339, VAT number GB 197 0632 86. Jisc's registered
office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice</p>
</font></font>
</body>
</html>