Mobile FIDO SDK Release notes

V4.1.0 - 14th August 2026

Supported platforms & processor architectures

Android

• Android 9.0 and later
• Processor architectures: armeabi-v7a, arm64-v8a, x86, x86_64

iOS

• iOS 16.0 and later
• Processor architectures: arm64, x86_64

New Features

• Custom AAGUID configuration: Configures an optional custom AAGUID per authenticator type (Biometric and Passcode). See Configure a custom AAGUID.
• Malware detection (Android): Runtime malware detection to identify threats on the device. See Security guidelines.
• Environment and tamper detection: Detects compromised runtime environments and unauthorized binary modifications. See Security guidelines.

Improvements

• Biometric security (Android): Invalidate keys if system biometrics (such as fingerprints) are added or removed.
• Biometric unenrollment handling: Automatically delete SDK biometric records when biometrics are completely unenrolled.
• Certificate pinning: Enhanced certificate pinning and validation logic.
• Additional security improvements: General security improvements.

V4.0.1 (Android) - 6th November 2025

New Features

• Hybrid transport is now supported on Android devices' browsers.

Bug fixes

• Fixed a bug that occurred when authenticating with a biometric authenticator in a multi-user scenario.

V4.0.0 - 11th September 2025

Supported platforms & processor architectures

Android

• Android 8.0 and later

• Processor architectures: armeabi-v7a, arm64-v8a, x86, x86_64

iOS

• iOS 15 and later

• Processor architectures: arm64, x86_64

New Features

Use cases

This release supports the following two use cases of the FIDO2 specifications:

• MakeCredentials

• GetAssertion

Known Issues

• NIL

Known limitations on iOS

iOS01. Modifications to existing biometry set

The SDK does not have control over changes to the device’s biometric configuration. If users modify their enrolled biometrics on the device (for example, add or remove fingerprints) after the initial enrollment, authentication with the existing biometric authenticator still succeed.

iOS02. Hybrid flow Support

To support hybrid flows on iOS, the SDK now enforces Backup Eligibility (BE) and Backup State (BS) flags to be set to true to complete the credential creation and assertion flow, while the device-bound passkeys are not eligible for backup.

Tested Devices

Android:

iOS: