From f89ee5e24a7d11e50678e4199e9ba335131ce03a Mon Sep 17 00:00:00 2001
From: Rory& <root@rory.gay>
Date: Wed, 6 May 2026 19:11:09 +0200
Subject: [PATCH] Security: make sure the security key matches up with the user
 by last TOTP ticket

---
 src/api/routes/auth/mfa/webauthn.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/api/routes/auth/mfa/webauthn.ts b/src/api/routes/auth/mfa/webauthn.ts
index 8e6c5f039..3acd423e5 100644
--- a/src/api/routes/auth/mfa/webauthn.ts
+++ b/src/api/routes/auth/mfa/webauthn.ts
@@ -72,6 +72,7 @@ router.post(
 
         const securityKey = await SecurityKey.findOneOrFail({
             where: {
+                user_id: user.id,
                 key_id: Buffer.from(clientAttestationResponse.rawId, "base64url").toString("base64"),
             },
         });