From ea1ba35dca5ff40d6f32091fb200fd72e16c6811 Mon Sep 17 00:00:00 2001
From: Eric Peterson <eric@elpete.com>
Date: Fri, 28 Aug 2026 09:26:16 -0600
Subject: [PATCH] fix: read nested handler annotations

---
 system/web/context/EventHandlerBean.cfc          |  5 +++--
 tests/specs/web/context/EventhandlerBeanTest.cfc | 12 ++++++++++++
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/system/web/context/EventHandlerBean.cfc b/system/web/context/EventHandlerBean.cfc
index 8f14b9a97..dac850602 100644
--- a/system/web/context/EventHandlerBean.cfc
+++ b/system/web/context/EventHandlerBean.cfc
@@ -155,8 +155,9 @@ component accessors="true" {
 		}
 
 		// Filter by key
-		if ( !isNull( variables.handlerMetadata[ arguments.key ] ) ) {
-			return variables.handlerMetadata[ arguments.key ]
+		var annotations = variables.handlerMetadata.keyExists( "annotations" ) ? variables.handlerMetadata.annotations : variables.handlerMetadata
+		if ( structKeyExists( annotations, arguments.key ) ) {
+			return annotations[ arguments.key ]
 		}
 
 		// Nothing found, just return the default value of empty string
diff --git a/tests/specs/web/context/EventhandlerBeanTest.cfc b/tests/specs/web/context/EventhandlerBeanTest.cfc
index a953ef81f..130e6cd66 100755
--- a/tests/specs/web/context/EventhandlerBeanTest.cfc
+++ b/tests/specs/web/context/EventhandlerBeanTest.cfc
@@ -129,4 +129,16 @@
 		expect( this.ehBean.isMetadataLoaded() ).toBe( true );
 		</cfscript>
 	</cffunction>
+
+	<cffunction name="testGetNestedHandlerMetadata" access="public" returnType="void">
+		<cfscript>
+		this.ehBean.setHandlerMetadata( {
+			name        : "PasskeyRegistration",
+			annotations : { secured : "" }
+		} );
+
+		expect( this.ehBean.getHandlerMetadata( "secured", false ) ).toBe( "" );
+		expect( this.ehBean.getHandlerMetadata( "missing", false ) ).toBeFalse();
+		</cfscript>
+	</cffunction>
 </cfcomponent>