Security Advisory FUT-2026-001 — Critical Vulnerability — No Customer Action Required

Summary: Futurae identified and remediated a critical vulnerability affecting its backend APIs. The vulnerability could have allowed an attacker to impersonate a customer’s backend and successfully complete MFA authentication requests on behalf of end users.

Timeline:

• 14 July 2026: Vulnerability reported through Bug Bounty Program.
• 15 July 2026: Fix implemented, validated, and deployed across Futurae’s infrastructure.

Customer action: No customer-side action is required. The remediation has been fully deployed within Futurae’s managed infrastructure.

Scope: Customers using Futurae backend APIs.

Impact: The vulnerability could have enabled unauthorized usage of the Futurae backend APIs. It could not have been used to access or extract Futurae or customer-specific cryptographic keys or secrets.

Verification: Following remediation, Futurae conducted a review of available backend API audit logs and telemetry. Based on this review, Futurae found no evidence that the vulnerability had been exploited.

Acknowledgments: Futurae thanks Daffa (“clearlovefanboi”) for responsibly disclosing this vulnerability through our Bug Bounty Program.

For any questions, please contact support@futurae.com.