FT-S-1 — Attacker replays biometric session token to re-use completed liveness check

Component: Biometric Verification. Mitigations: Session tokens are single-use; FaceTec server validates. Action: None required.

Property	Value
Section	Spoofing
Owner	platform

Mapped Controls

Control	Title
SID-AUTH-01	FIDO2/WebAuthn Passwordless Authentication

---

Source: STRIDE analysis (April 2026), architecture/stride-threat-model.md