diff --git a/package.json b/package.json
index 497264d..4315e0d 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "trackarr",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "type": "module",
   "private": true,
   "scripts": {
diff --git a/server/middleware/security.ts b/server/middleware/security.ts
index 85eac64..a594f78 100644
--- a/server/middleware/security.ts
+++ b/server/middleware/security.ts
@@ -229,8 +229,8 @@ export default defineEventHandler(async (event) => {
   }
 
   // 2. Check User Ban (for authenticated sessions)
-  // Skip for auth routes to avoid blocking login/logout
-  if (!path.startsWith('/api/auth/')) {
+  // Skip for auth routes and Torznab API (has its own passkey auth)
+  if (!path.startsWith('/api/auth/') && !path.startsWith('/api/torznab')) {
     const session = await getUserSession(event);
 
     if (session.user) {