Authenticator processes OTP deep links before completing local authentication

Finding IDs

F-PROTON-IOS-AUTH-001

Status

fixed publicly

Fixed in

1.4.0 source tag; App Store delivery not independently verified

Note

Opening an otpauth deep link while the application is locked could enter the import path before authentication. The 17 April 2026 patch defers the URL in pendingDeepLink while showEntries is false and processes it only after authenticated entries may be shown. The same gate is present in tag 1.4.0. The confirmed change is the ordering of local authentication and deep-link handling. It is not evidence of secret extraction, nor an independent runtime demonstration that the locked vault was modified. Presence in a source tag does not establish the delivery date or contents of an App Store binary. Public-source review does not establish vendor attribution, an assigned severity or a fresh end-to-end retest.

F-PROTON-IOS-AUTH-001: Access control. An incoming OTP URL reaches import processing before the local authentication gate is satisfied. Reviewed 26 Sep 2026. Mechanism assessed by 1seal.

Mechanism source for F-PROTON-IOS-AUTH-001

Security area (1seal assessment): Authorization. An incoming OTP URL reaches import processing before the local authentication gate is satisfied. Reviewed 26 Sep 2026.

• Source: github.com (external) ↗
• F-PROTON-IOS-AUTH-001
• 1.4.0: authentication gate and pending deep link
• Classification source