4.20.1 (2026-11-03) Bug Fixes apply log level and masking to OTEL log export (#12997) (64b3915), closes #12045 #12996 #12045 #12996 drop user search trigger on session creation (#13027) (709968c), closes #9635 #6537 login: keep the sessions cookie within the browser size limit (#12995) (4930911), closes #12968 #12656 #12735 #12520 login: replace deepmerge in i18n message merging (#13013) (7c6ca4b)…
4.20.0 (2026-10-22) ⚠️ Upgrade notes Go 1.26: ZITADEL is now built with Go 1.26.10. Outbound TLS connections (SMTP, external IdPs, Actions and webhook targets, HTTP SMS providers) no longer accept certificate chains through the compromised eMudhra intermediate CAs (#12969); affected endpoints need a new certificate, the check can't be disabled. Go 1.26 also rejects URLs with invalid colons in the…
4.19.5 (2026-10-15) ⚠️ Upgrade notes Device authorization: users now confirm the device on a consent screen. If a project requires a grant to authenticate, users without one can no longer sign in through the device flow. Custom login UIs need the session.read permission for GetDeviceAuthorizationRequest. Login V2: email and invite verification, passkey registration and IdP linking are now also pro…
4.19.4 (2026-10-01) Bug Fixes actions: set instance ID in async execution worker context (#12730) (03a2469), closes #11985 notification: correct ID order of the invite code sent handler (#12846) (101343a) skip finalized unique-constraint backfill and exclusive owner deletes (#12833) (aee8b88), closes #12831 #12834
4.19.3 (2026-09-29) Performance Improvements query: index users14 by instance and org (#12830) (d378dea), closes #12826 query: stop expanding login names for every ListUsers row (#12826) (2c6acd8), closes #10037 #10840 #11768 #12830
This release fixes three security vulnerabilities. We recommend all 4.x deployments upgrade. Security GHSA-x4c7-fpcx-w9q6 (high): SAML identity-provider confusion leading to account takeover GHSA-jh92-5mrj-p2w2 (high): account takeover through the unsigned Login V2 session cookie GHSA-w4gv-rcwj-w6r5 (low): end-user impersonators could impersonate administrators ⚠️ Upgrade notes for the Login UI (L…
4.19.1 (2026-09-23) Bug Fixes setup step 79 batch unique constraint owner backfill (#12803) (42cdd5d)
⚠️ Please skip this release and use v4.19.0. The setup step fails in this version (issue). 4.18.0 (2026-09-21) Bug Fixes eventstore: add owners to unique constraints (#12740) (c397a60) eventstore: prevent projections from skipping events (#12703) (d49a665), closes #8509 #10480 #10560 #10710 login: forward login_hint to the external IdP (#12760) (482ddc7), closes #6899 #11552 #12080 #12683 login: v…
4.19.0 (2026-09-23) Bug Fixes eventstore: omit owners on empty unique constraint inserts (#12785) (6308539), closes #12740 #12780 #12740 Features eventstore: remove application constraints by app owner (#12798) (765027e)
4.17.3 (2026-09-04) Bug Fixes crypto: use authenticated encryption for IDP intent tokens (41b1114) login: authorize IDP linking via enrollment guard, not isSessionValid (a53fbc4) login: translate authentication and OTP strings (#12668) (739e91e), closes #12481 #12226 security: check auth method permission on the user's organization (20f0984)
4.17.2 (2026-08-31) Bug Fixes api: correct caching and relations of well-known app link files (#12634) (21dbb2e), closes #12580 #12497 api: prevent cross-instance caching of well-known app link files (#12644) (f0329f0), closes #12634 #12634 #12634 #12497 console: support Zitadel Support IDP (#12619) (c543449), closes #11825 #5127 #12018 #12056 #12371 #12378 #12384 #12394 #12396 #12422 #12469 #1253…
3.4.15 (2026-08-14) Bug Fixes command: enforce permission check when issuing passkey enrollment codes (67f9d29) login: require MFA prompt step before 2FA enrollment (d81ab1c)
4.17.1 (2026-08-14) Bug Fixes block Login V2 auth for users in deactivated organizations (a9311b8) command: enforce permission check when issuing passkey enrollment codes (76dd58e) login: prevent the browser from requesting OTP codes via returnCode (5f75afb) login: require MFA prompt step before 2FA enrollment (db42371)
4.17.0 (2026-08-12) Bug Fixes actions: allow adding raw metadata values via appendMetadataRaw (#12567) (c1b9885), closes #10666 #5526 #10470 #5526 allow invite codes for users whose auth methods were all removed (#12453) (eb7af25) api: accept SetSecuritySettings on /v2/settings/security (#12518) (6e07fb7), closes #12313 console: change username abort dialog and set email as verified #10803 #12146…
4.16.3 (2026-08-07) Bug Fixes telemetry: record route patterns instead of request paths on HTTP metrics (#12557) (beffd5e), closes #9286 #9523 #11435 #12315 #12556 #9286 #9523 #11435
3.4.14 (2026-07-29) Bug Fixes login: prevent external-IDP account pre-hijack in Login V1 (da67750) login: require authentication before WebAuthn/U2F and TOTP/OTP enrollment (dd975b8)
4.16.2 (2026-07-29) Bug Fixes improve random string generation (#12266) (34345ea) login: prevent external-IDP account pre-hijack in Login V1 (917ade3) login: redirect to external IdP after domain discovery regardless of registration policy (#12369) (c4ba5a1), closes #12021 #12023 login: require authentication before WebAuthn/U2F and TOTP/OTP enrollment (c20d613) use protected http client for org d…
3.4.13 (2026-07-17) Bug Fixes actions: prevent disk access via require (e28d6bc)
4.16.1 (2026-07-17) Bug Fixes actions: prevent disk access via require (afe1086) console: display minimum length in password complexity message (#12419) (cc3812a), closes #12390 login: keep submit button disabled/loading during password set r… (#12429) (0a355f7), closes #12416 login: prevent crash on a stale session cookie (#12423) (6030a43), closes #11130
4.16.0 (2026-07-10) Bug Fixes correct scope validation in token exchange (#12312) (02d07e9), closes #12319 #12322 #12319 #12322 Correctly remove adjacent roles on user grants (dc89900) increase performance of ListUser by login name ignore case (#12350) (8fed358) login: allow custom protocols for native apps again (#12332) (5b3c10e) login: improve contrast of IDP processing message (#12309) (30ad9a…
4.15.3 (2026-06-22) Bug Fixes added client and scope validation for token exchange (e2886a6) ensure external user's email is verified before auto-linking (c97012f) login: center text for generic IDP buttons without icons (#12211) (aadc664), closes #12182 login: guard defaultRedirectUri in OIDC/SAML FailedPrecondition paths (0382659)
3.4.12 (2026-06-17) Bug Fixes always validate exp and iat claims of JWT IdPs (d1c3aa8) client_id verification during code exchange and refresh token flows (5b1708e) jwt idp: manage and validate audience (42f629d)
4.15.2 (2026-06-17) Bug Fixes always validate exp and iat claims of JWT IdPs (4925fab) client_id verification during code exchange and refresh token flows (5624030) connection handling in setup after migration steps 40, 64 and 70 (#12293) (c53d977) eventstore: allow overwriting resource owner of events (#12261) (a939b84) idp: apply PKCE when building OAuth and OIDC providers (#12247) (ab7c6c0), cl…
4.15.1 (2026-06-08) Bug Fixes api: check permission based on provided data on user updates (a1748b2) login: apply custom request headers from environment variable in proxy (#12144) (aad90ce), closes #12125 login: redirect to email verification when forced MFA has no visible factors (#12060) (9618e33), closes #11536 login: retry logic for session creation after registration on NotFound (#12189) (53…
3.4.11 (2026-06-10) Bug Fixes api: check permission based on provided data on user updates (90f3102)
3.4.10 (2026-05-04) Bug Fixes ldap: escape username filter (59fa301)
4.15.0 (2026-05-04) Bug Fixes console: delete role assignment in admin profile #10376 (#11867) (c1e62e1) console: display actions v1 with correct permissions #12001 (#12068) (1358d08) ldap: escape username filter (a56d4bf) login: lru-cache compatibility, improve session error handling (#12099) (760cd7e) login: resolve localized legal links in signup (#11913) (73f8e28), closes #11907 Features conso…
4.14.0 (2026-04-24) Bug Fixes console: always show settings page to admin (#11779) (2f81454), closes #10912 console: disallow smtp double create #8964 (#11868) (aeddf0e) console: Fix onboarding link for user login guide (#11958) (677450e) console: jwt provider callback urls #11589 (#11966) (bfbf943) console: normalize empty OIDC redirect uri updates #12053 (#12067) (c16667b) console: pass data to…
4.13.1 (2026-04-01) Bug Fixes do not send init mails for admins on instance setup (#11744) (60a4f3b) make recovery code active on add (#11734) (9ac2518) revert feature key for configs back to ConsoleUseV2UserApi (#11928) (7ead851), closes #11390 #11706 use preparation filter for org existence check during setup (#11932) (3ef1593), closes #11677
4.13.0 (2026-03-23) Bug Fixes check whether org exists before creating user (#11647) (ac046ee), closes #11532 console: manager removal #11543 (#11627) (853a253) console: organization column display in grants #10822 (#11742) (7374804) console: role assignment manipulation #10517 (#11756) (88a3c23) console: switch to webkeys v2 (from v2beta) (#11807) (d1230ce), closes #10773 login: disable auto-capi…