diff --git a/CHANGELOG.md b/CHANGELOG.md
index c1d10d71..4b5d8158 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,19 @@
+## v0.16.4
+### Security
+> [!CAUTION]
+Fixes a critical vulnerability where, in rare cases, registered users could temporarily inherit another user's session. This was caused by an incorrectly scoped PocketBase instance being shared across concurrent requests on the server.
+
+Impact:
+  - Affects all versions prior to v0.16.4
+  - Risk of temporary user session mix-up during concurrent requests
+
+Fix:
+  - Authentication is now correctly isolated per request
+  - Session handling is fully secured on both client and server
+
+Action Required:
+  - Please update to v0.16.4 immediately and restart your wanderer instance to apply the fix
+
 # v0.16.3
 ## Features
 - Adds option to add waypoints directly by uploading photos with EXIF data
diff --git a/docs/src/content/docs/getting-started/changelog.md b/docs/src/content/docs/getting-started/changelog.md
index 4671455b..a7d1efbe 100644
--- a/docs/src/content/docs/getting-started/changelog.md
+++ b/docs/src/content/docs/getting-started/changelog.md
@@ -2,6 +2,23 @@
 title: Changelog
 description: What changed in the last patch?
 ---
+## v0.16.4
+### Security
+:::caution
+Fixes a critical vulnerability where, in rare cases, registered users could temporarily inherit another user's session. This was caused by an incorrectly scoped PocketBase instance being shared across concurrent requests on the server.
+:::
+
+Impact:
+  - Affects all versions prior to v0.16.4
+  - Risk of temporary user session mix-up during concurrent requests
+
+Fix:
+  - Authentication is now correctly isolated per request
+  - Session handling is fully secured on both client and server
+
+Action Required:
+  - Please update to v0.16.4 immediately and restart your wanderer instance to apply the fix
+  
 ## v0.16.3
 ### Features
 - Adds option to add waypoints directly by uploading photos with EXIF data