The problem is that the server cannot store a hash of the fingerprint, because the fingerprint can come with slight variations that would give a completely different hash. And if your fingerprint is compromised (either by taking it on a object you have touched or directly from the server) you can hardly change it - ok you can use up to ten fingers.
But a fingerprint can be a correct way to unlock a private key, because it become close to a 2FA authentication: something you have (the private key) and something you are (the fingerprint). And in case of compromission, you can always revoke the key. That means that to securely use fingerprint for authentication, you should combine it with X509 certificates.