Z
v3.4.14
3.4.14 (2026-07-29) Bug Fixes login: prevent external-IDP account pre-hijack in Login V1 (da67750) login: require authentication before WebAuthn/U2F and TOTP/OTP enrollment (dd975b8)
Z
v4.16.2
4.16.2 (2026-07-29) Bug Fixes improve random string generation (#12266) (34345ea) login: prevent external-IDP account pre-hijack in Login V1 (917ade3) login: redirect to external IdP after domain discovery regardless of registration policy (#12369) (c4ba5a1), closes #12021 #12023 login: require authentication before WebAuthn/U2F and TOTP/OTP enrollment (c20d613) use protected http client for org d…
Z
v3.4.13
3.4.13 (2026-07-17) Bug Fixes actions: prevent disk access via require (e28d6bc)
Z
v4.16.1
4.16.1 (2026-07-17) Bug Fixes actions: prevent disk access via require (afe1086) console: display minimum length in password complexity message (#12419) (cc3812a), closes #12390 login: keep submit button disabled/loading during password set r… (#12429) (0a355f7), closes #12416 login: prevent crash on a stale session cookie (#12423) (6030a43), closes #11130
Z
v4.16.0
4.16.0 (2026-07-10) Bug Fixes correct scope validation in token exchange (#12312) (02d07e9), closes #12319 #12322 #12319 #12322 Correctly remove adjacent roles on user grants (dc89900) increase performance of ListUser by login name ignore case (#12350) (8fed358) login: allow custom protocols for native apps again (#12332) (5b3c10e) login: improve contrast of IDP processing message (#12309) (30ad9a…
Z
v4.15.3
4.15.3 (2026-06-22) Bug Fixes added client and scope validation for token exchange (e2886a6) ensure external user's email is verified before auto-linking (c97012f) login: center text for generic IDP buttons without icons (#12211) (aadc664), closes #12182 login: guard defaultRedirectUri in OIDC/SAML FailedPrecondition paths (0382659)
Z
v3.4.12
3.4.12 (2026-06-17) Bug Fixes always validate exp and iat claims of JWT IdPs (d1c3aa8) client_id verification during code exchange and refresh token flows (5b1708e) jwt idp: manage and validate audience (42f629d)
Z
v4.15.2
4.15.2 (2026-06-17) Bug Fixes always validate exp and iat claims of JWT IdPs (4925fab) client_id verification during code exchange and refresh token flows (5624030) connection handling in setup after migration steps 40, 64 and 70 (#12293) (c53d977) eventstore: allow overwriting resource owner of events (#12261) (a939b84) idp: apply PKCE when building OAuth and OIDC providers (#12247) (ab7c6c0), cl…
Z
v4.15.1
4.15.1 (2026-06-08) Bug Fixes api: check permission based on provided data on user updates (a1748b2) login: apply custom request headers from environment variable in proxy (#12144) (aad90ce), closes #12125 login: redirect to email verification when forced MFA has no visible factors (#12060) (9618e33), closes #11536 login: retry logic for session creation after registration on NotFound (#12189) (53…
Z
v3.4.11
3.4.11 (2026-06-10) Bug Fixes api: check permission based on provided data on user updates (90f3102)
Z
v3.4.10
3.4.10 (2026-05-04) Bug Fixes ldap: escape username filter (59fa301)
Z
v4.15.0
4.15.0 (2026-05-04) Bug Fixes console: delete role assignment in admin profile #10376 (#11867) (c1e62e1) console: display actions v1 with correct permissions #12001 (#12068) (1358d08) ldap: escape username filter (a56d4bf) login: lru-cache compatibility, improve session error handling (#12099) (760cd7e) login: resolve localized legal links in signup (#11913) (73f8e28), closes #11907 Features conso…
Z
v4.14.0
4.14.0 (2026-04-24) Bug Fixes console: always show settings page to admin (#11779) (2f81454), closes #10912 console: disallow smtp double create #8964 (#11868) (aeddf0e) console: Fix onboarding link for user login guide (#11958) (677450e) console: jwt provider callback urls #11589 (#11966) (bfbf943) console: normalize empty OIDC redirect uri updates #12053 (#12067) (c16667b) console: pass data to…
Z
v4.13.1
4.13.1 (2026-04-01) Bug Fixes do not send init mails for admins on instance setup (#11744) (60a4f3b) make recovery code active on add (#11734) (9ac2518) revert feature key for configs back to ConsoleUseV2UserApi (#11928) (7ead851), closes #11390 #11706 use preparation filter for org existence check during setup (#11932) (3ef1593), closes #11677
Z
v4.13.0
4.13.0 (2026-03-23) Bug Fixes check whether org exists before creating user (#11647) (ac046ee), closes #11532 console: manager removal #11543 (#11627) (853a253) console: organization column display in grants #10822 (#11742) (7374804) console: role assignment manipulation #10517 (#11756) (88a3c23) console: switch to webkeys v2 (from v2beta) (#11807) (d1230ce), closes #10773 login: disable auto-capi…