Song: https://www.youtube.com/watch?v=Hef-Zf6frk0
Passbolt 5.17.0 "Mad World" introduces passkeys for multi factor authentication, improves autofill reliability across websites, makes permission changes easier to review when moving resources, and brings PIN code resources to QuickAccess. This release also includes security fixes and performance improvements.
Passkeys for MFA
Passbolt 5.17 adds passkeys as a second authentication factor, alongside the TOTP, Yubikey OTP and Duo providers that are already supported. It answers a requirement that many organisations now include in their procurement processes: multi-factor authentication that resists phishing, which one-time codes cannot provide.
Built on the WebAuthn/FIDO2 standard, it is bound to the domain of the Passbolt instance, and the browser refuses to use it anywhere else, so a lookalike site has nothing to capture. Basically, one-time code can be typed into a fake login page and relayed to the real site by an attacker. Passkeys cannot be used this way and protects against this kind of phishing.
Passkeys are available in every edition. Once an administrator enables them in Administration > Multi-factor authentication, each user can register up to ten passkeys from Profile > Multi-factor authentication, using a security key such as a YubiKey or the biometrics built into their laptop, phone, such as Touch ID or Windows Hello.
From then on, Passbolt asks for the passkey right after sign-in, as it does for the other providers. Users can tick "Remember this device for a month" to skip the check on a trusted device, or leave it unticked to verify every time. Organisations using Passbolt Pro edition, and wanting a stricter posture can disable this option in the Multi-factor authentication policy settings, so that every sign-in requires the passkey.
This first step covers multi-factor authentication. Storing passkeys for third-party websites as a resource type and Passwordless sign-in to Passbolt will follow in upcoming releases.
A new autofill detection engine
Autofill is a core part of the Passbolt browser experience, and version 5.17 rebuilds its detection engine from scratch. It tackles two familiar frustrations: no autofill on a form that clearly needs it, and an autofill icon in a field that has nothing to do with credentials.
Getting this right is harder than it looks, because no two websites build their forms the same way. Field names differ, labels come in many languages, and the underlying code varies widely from one site to the next. A handful of regular expressions could only go so far, and the previous engine had reached its limits.
The new engine understands the context of each field, from the structure of the form to the labels around it, before deciding whether to step in. The first benchmarks are very promising: on our internal test set, form detection rises from 74% with the previous engine to 93.4%, while processing cost stays low.
A test set is not the web, though, and this is where the community comes in: we are eager to hear how the engine behaves on the websites our users rely on every day. For those curious about the inner workings, a detailed blog post will follow.
Safer permission handling during resource moves
Passbolt 5.17 brings the permission review introduced in 5.14 to moves of resources and folders. Creating a resource in a shared folder, editing a shared resource and now moving items all ask for the same explicit confirmation.
A move needs this step because placing a resource in a shared folder, or taking it out of one, can change who has access to it. Previously, users chose between keeping the current permissions and applying those of the destination folder, without seeing what either option would produce. Getting it right meant anticipating the outcome, which could be confusing.
From this version, every move follows the destination folder strategy: permissions inherited from the origin parent folder are removed, and those of the destination folder take their place. Before saving, Passbolt shows who will gain, lose or keep access, and this proposal can be refined with the usual granular control, one user or group at a time. Nothing changes until the user confirms, and the operation can still be cancelled.
Access PIN Codes through QuickAccess
This release brings PIN codes to QuickAccess. Users no longer need to switch to the web workspace to retrieve door codes or device PINs.
PIN codes also inherit offline availability, using the same security and synchronization controls as other secrets, as described in the Offline Mode blog post.
This is part of a broader effort to expand QuickAccess and Offline Mode support to all remaining resource types in upcoming releases.
Large organization group management performance
The release also tackles one of the most requested improvements on adding a user to a large group with many shared resources. This operation is now more than twice as fast and is achieved through optimizing the underlying database queries. This cuts the wall time for adding a user to a group having access to 300 resources from 1.19 seconds to 514 milliseconds. Now, administrators can spend less time waiting when onboarding users or reorganizing access in large groups with many shared resources.
Security Improvements
Passbolt 5.17.0 brings targeted security improvements and hardening measures resulting from internal assessments and external research.
-
Safer Cookie Handling in Safari: Cookie management within the Safari extension is strengthened following insights from the recent Cure53 audit. Cookies are now more strictly isolated preventing them from being unintentionally exposed to other hosts
-
Clipboard Auto-Clear Protection: Thanks to a report from external researcher Alex J, an edge case has been fixed where a malicious website could intercept, copy or cut events to cancel the clipboard-clearing timer. Copied secrets are now reliably cleared from the clipboard as intended.
-
SCIM Token Enforcement (Pro Edition): Expired SCIM bearer tokens are now strictly rejected to prevent unauthorized ongoing access to provisioning endpoints. Administrators also receive proactive health checks and daily notifications, when the token is used and nearing expiration.
A dedicated security bulletin will be published soon. It will provide more details on each of the resolved issues, including their potential impact and how they were addressed.
Updating to Passbolt 5.17.0 is recommended to benefit from these security improvements.
Conclusion
Many thanks to everyone who provided feedback, reported bugs and contributed to making Passbolt better.
Changelog
Added
PB-53327 Include group membership changes in the permission drift calculation before saving
PB-53450 AUTOFILL - WP 2.0 - Create the orphanDictionary for the DOM extraction
PB-53451 Add OrphanFieldPredicates class to check whether an element is a button
PB-53452 AUTOFILL - WP 2.2 - Create the FieldVisibilityService to avoid detection of hidden inputs
PB-53460 Add FormExtractionService to gather forms with viewable text fields
PB-53461 AUTOFILL - WP 2.4 - Create the OrphanFieldsExtractionService to extract build the orphan forms
PB-53462 Create NestedFormExtractionService
PB-53464 Rework InFormCredentialsFormField
PB-53465 AUTOFILL - WP 2.8 - Update the InFormManager to use the new extraction logic
PB-53466 AUTOFILL - WP 3.0 - Create the TextNormalizer as an helper to infer on extracted text
PB-53480 AUTOFILL - WP 3.1 - Create the ScrapingDictionary to handle scraping constants
PB-53482 AUTOFILL - WP 3.2 - Create the ScrapingIdentity to support identifier after scraping
PB-53483 AUTOFILL - WP 3.3 - Create the ScrapingCache object
PB-53484 AUTOFILL - WP 3.4 - Create the PageScraperHelpers to group helpers used for scraping
PB-53485 AUTOFILL - WP 3.5 - Create the LabelScraper to handle the label logic extraction
PB-53486 AUTOFILL - WP 3.6 - Create the FieldScraper to handle the field extraction
PB-53487 AUTOFILL - WP 3.7 - Create the FormScraper to extract information from form
PB-53488 AUTOFILL - WP 3.8 - Create the FieldQualifier to detect the type of field scraped
PB-53489 AUTOFILL - WP 3.9 - Create the PageScraper
PB-53980 PCD - improve PCD on move operations
PB-54162 AUTOFILL - WP 4.0 Create keywordsDictionary for classification
PB-54163 AUTOFILL - WP 4.1 Create taxonomy for classification
PB-54165 AUTOFILL - WP 4.2 Create KeywordMatchingService
PB-54167 AUTOFILL - WP 4.3 Create FieldFeatureService
PB-54168 AUTOFILL - WP 4.4 Create FormClassificationService
PB-54171 AUTOFILL - WP 4.5 Create SawfClassificationService
PB-54172 AUTOFILL - WP 4.6 Create PasswordRoleResolutionService
PB-54173 AUTOFILL - WP 4.7 Create FieldsRationalizationService
PB-54184 AUTOFILL - WP 4.8 Create SegmentedOtpResolutionService
PB-54185 AUTOFILL - WP 4.9 Create ClassificationService
PB-54336 AUTOFILL - WP 4.10 Create PageClassificationService
PB-54337 AUTOFILL - WP 4.11 Connect the new service to the fill plan
PB-54346 AUTOFILL - Fill not working on modal when z index is high
PB-54374 AUTOFILL - Call-to-action missing on first focus for shadow-DOM fields
PB-54344 AUTOFILL - Autocomplete should not block when it not valid
PB-54500 Quick access: list PIN code resources
PB-54502 Quick access: display PIN code in the resource view page
PB-54530 AUTOFILL is not working for input length attribute
PB-54571 Add the Passkeys provider toggle to the MFA administration page
PB-54596 Implement the restartable WebAuthn setup ceremony
PB-54608 OFM - PIN Code as offline available resource
PB-54706 Show the Passkeys card in the user MFA provider overview
PB-54707 Add the passkey authenticator icon set and AAGUID mapping to the styleguide
PB-54709 Add the passkey registration flow to the Passkeys settings page
PB-54710 Implement the WebAuthn MFA verification page as a styleguide React application
PB-54759 BEST - WP 1.1 - Implement ScimEntity for Healthcheck
PB-54760 BEST - WP 1.2 - Update HealthcheckEntity to handle the new ScimEntity
PB-54761 BEST - WP 1.3 - Update DisplayScimSettingsAdministration to handle the new expiry behaviour
PB-55047 Prune fields nested in forms deeper than the one evaluated
PB-55050 False positive on first name and inform menu blinking
PB-55099 Fix add user to group progress dialog for offscreen
PB-55115 Implement the delegated WebAuthn MFA verification page for the mobile applications
Fixed
PB-53265 Autocomplete fails in share dialog when custom email validator is on
PB-54103 Fix null reference on storage change event
PB-54531 Editing resources in a group-view doesn't update the grid
PB-54764 OFM button not presented to eligible authenticated user with mfa required and API unavailable
PB-54790 Prevent potential issue with TOTP autofill
PB-54818 Offline mode plane icon stroke width should be 1.5px instead of 2px
PB-54841 Fix quickaccess tab not opening when an account is not configured
PB-54976 AUTOFILL - Plex CTA is blinking
PB-55046 AUTOFILL - agoda email is not fillable
PB-55048 AUTOFILL - Focus on a input should keep the CTA
PB-55136 AUTOFILL - confirm password should be filled on a form
PB-55155 AUTOFILL - Fix ant design search input is not working
Security
PB-52830 restrict retrieved cookie on Safari to what a browser would normally get back
PB-52831 Ensures Safari does not accept unexpected redirection to avoid cookie leakage
PB-52832 Fix parameter name in sanitizeUrl function
PB-53545 Major upgrade for yargs (Low)
PB-53942 Fix image-size GHSA-5p2g-fcmc-qvqq - HIGH CVSS4.0
PB-54648 Fix adm-zip GHSA-vwc7-r8mq-g2x9 - CVSS4.0 MEDIUM
PB-54751 Major upgrade for @noble/hashes (Low) - passbolt-styleguide
PB-55262 Fix undici multiple CVEs - CVSS3.1 HIGH
PB-55264 Fix axios multiple CVEs - CVSS3.1 HGH
PB-55267 Fix braces-expansion multiple CVEs - CVSS3.1 HIGH
PB-55268 Fix braces GHSA-vfj7-8cjw-p6xm - CVSS3.1 HIGH
PB-55274 Fix shell-quote GHSA-pqg4-j6r4-53mv - CVSS4.0 CRITICAL
PB-55276 Fix fast-uri multiple CVEs - CVSS3.1 HIGH
PB-55277 Fix source-map-js GHSA-68fv-2mgg-jv7q - CVSS4.0 HIGH
PB-55279 Fix i18next-http-backend GHSA-xvq9-wjp8-hwqf - CVSS3.1 LOW
PB-55293 Fix joi multiple CVEs - CVSS4.0 HIGH
PB-55295 Fix probe-image-size GHSA-gjj5-9665-rwrc - CVSS3.1 HIGH
PB-54842 clipboard auto-clear bypass via untrusted copy/cut DOM event
Maintenance
PB-49117 optimise tab retrieval by id
PB-52127 SAF - Reactivate avatar handling from client
PB-54525 Product naming convention for Group Manager instead of Group Admin