Bug Fixes handlers: use correct status code for consent redirects (#13155) (b1d294e) by @james-d-elliott middlewares: include query in envoy authz path (#13167) (2bd25ba) by @james-d-elliott oidc: pre-configured consent saved twice (#13154) (58ee25d), closes #13153 by @james-d-elliott Docker Container docker pull authelia/authelia:4.39.27 docker pull ghcr.io/authelia/authelia:4.39.27
Bug Fixes oidc: allow conformant alg none jarm (#13110) (2ce5b5b) by @james-d-elliott Docker Container docker pull authelia/authelia:4.39.26 docker pull ghcr.io/authelia/authelia:4.39.26
Bug Fixes notification: smtp ipv6 literal addresses (#13051) (ffa6a89), closes #13041 by @james-d-elliott Docker Container docker pull authelia/authelia:4.39.25 docker pull ghcr.io/authelia/authelia:4.39.25
Bug Fixes suites: preserve log colours under go test -json (#13048) (c004538) by @nightah suites: restore single log group in suite test output (#13050) (84d2f55) by @nightah Docker Container docker pull authelia/authelia:4.39.24 docker pull ghcr.io/authelia/authelia:4.39.24
Bug Fixes configuration: remove the website attribute (#12981) (09bbe50), closes #12969 by @james-d-elliott oidc: client auth config strategy (#12976) (2a146c8), closes #12974 by @james-d-elliott oidc: client credentials subject foreign key violation (#13032) (fe1c228), closes #13018 by @james-d-elliott oidc: resource indicators grant (#12973) (01f1d1e), closes #12970 by @james-d-elliott oidc: use…
Bug Fixes storage: access token jwt upgrade (#12958) (84e41e5), closes #12957 by @james-d-elliott Docker Container docker pull authelia/authelia:4.39.22 docker pull ghcr.io/authelia/authelia:4.39.22
Bug Fixes api: missing and misleading endpoints (#12728) (b6de5c0) by @james-d-elliott authentication: pooled client skip (#12554) (7c34973) by @james-d-elliott authentication: stale user database aliases (#12755) (0c310f9) by @james-d-elliott authentication: uncessary read lock (#12620) (e0c4097) by @james-d-elliott authorization: deprecated wildcard consistency and did (#12340) (aed96e8) by @jam…
Security Fixes This release contains important security fixes. We encourage users to update as soon as practical. The following advisories accompany this release: Edge Case Access Control Rule Domain Miss Due to Lack of Canonicalization reported by @j0hndo, fixed by @james-d-elliott, reviewed by @nightah and @Crowley723 Missing Username Canonicalization in Basic Auth when using LDAP reported by @N…
Bug Fixes authentication: cache miss in edge case (#11541) (2df41dd) by @james-d-elliott authentication: fix ldapv3 version check (#11454) (f24ef6b) by @atoerien authorization: amr consistency (#11637) (4c92b2a) by @james-d-elliott handlers: recovered deref panic for otc (#11500) (1cc0d3d) by @james-d-elliott middlewares: stricter domain matching (#11685) (675d8b7) by @james-d-elliott ntp: use ful…
Security Fixes This release fixes security issues. For more information please see GHSA-gmfg-3v4q-9qr4. Bug Fixes authentication: discovery check too strict (#11350) (5c1633b), closes #10840 by @james-d-elliott authentication: excessive filter escape (#11285) (10f7603), closes #11284 by @james-d-elliott configuration: max retries default (#11173) (f29bb95) by @james-d-elliott disable npm scripts f…
4.39.15 (2025-11-29) Bug Fixes authentication: error determining ldap server health (#10753) (b6e14c7) by @james-d-elliott configuration: defaults not applied to server authz (#10793) (73bee22) by @james-d-elliott New Contributors @rowanarts made their first contribution in #10652 @mayswind made their first contribution in #10723 Docker Container docker pull authelia/authelia:4.39.15 docker pull g…
4.39.14 (2025-11-09) Bug Fixes authentication: ldap pool deadlock (#10527) (279c1be), closes #9936 #10392 by @james-d-elliott authentication: referrals not chased (#10608) (5ddb457), closes #10569 by @james-d-elliott authentication: remove singleflight debug logging (#10628) (4c1c6ee) by @Crowley723 expression: shallow value resolution (#10582) (bc0fb6c), closes #10558 by @james-d-elliott New Cont…
4.39.13 (2025-10-12) Bug Fixes authentication: basic auth cache multi-flight (#10522) (e25b66c) by @james-d-elliott regulation: pool deadline error incorrectly logged (#10521) (4b45d48) by @james-d-elliott Docker Container docker pull authelia/authelia:4.39.13 docker pull ghcr.io/authelia/authelia:4.39.13
4.39.12 (2025-10-08) Bug Fixes storage: oauth2 device code constraints (#10484) (26f3b89), closes #10404 by @james-d-elliott Docker Container docker pull authelia/authelia:4.39.12 docker pull ghcr.io/authelia/authelia:4.39.12
4.39.11 (2025-10-01) Bug Fixes handlers: webauthn experimental 2fa default redirection (#10426) (8c76ea3) by @nightah oidc: remember consent ignored (#10384) (5cd17eb) by @james-d-elliott web: consent remember ux (#10347) (e9a4047) by @james-d-elliott New Contributors @gene1wood made their first contribution in #10340 Docker Container docker pull authelia/authelia:4.39.11 docker pull ghcr.io/authe…
Bug Fixes duo: remove incorrect response code check for successful api calls (#11723) (310844b) by @Crowley723 Docker Container docker pull authelia/authelia:4.39.18 docker pull ghcr.io/authelia/authelia:4.39.18
Bug Fixes handlers: oauth2 inconsistent error messages (#11745) (dcae991) by @james-d-elliott middlewares: issuer domain suffix check (#11758) (c6c8c0c) by @james-d-elliott middlewares: misleading issuer error (#11749) (6ceeb2c) by @james-d-elliott server: healthcheck env written late (#11639) (d259426) by @james-d-elliott New Contributors @Phur3ouZ made their first contribution in #11736 @ishanja…