Changelog Features fb38eae feat: add group add/delete actions to group tree page 39a1bba feat: support popup mode for Captcha providers Bug fixes 0f629eb fix: URL-encode OAuth state on interactive login, consent, prompt, signup and post-logout redirects 1d65427 fix: allow only global admins to change applications' custom HTML f82480a fix: allow org admins to import groups, roles and permissions vi…
Version 202638added B2B Connect - Enterprise in Early Access! You can now connect your existing authorization server to Auth0 for enterprise SSO, SCIM provisioning, and multi-tenant org management — without migrating your users. What's new B2B Connect Beta let you layer Auth0 enterprise identity on top of your own authorization server. Early Access adds real-time visibility into enterprise directo…
Version 202638added Enterprise Connection Events — Early Access You can now stream real-time notifications when an enterprise connection changes — without polling the Management API. What's new Previously, detecting changes to an enterprise connection (a new SSO connection added, an existing one updated, or one removed) required polling the Management API on a schedule. With connection events, Aut…
Changelog Features d60b5ae feat: add configurable password history check e1aa116 feat: add organization-level defaultTokenFields for new applications d6f2cb6 feat: show device, IP and last active time for each session e7f2799 feat: support app-level dark logo fbacaea feat: support group-level subscriptions ed417c1 feat: support invite-only pricing Bug fixes 3eb9231 fix(web): keep draft rows in key…
FusionAuth 1.69.2 fixes a critical security issue.
See https://docs.goauthentik.io/docs/releases/2026.8#fixed-in-202682
See https://docs.goauthentik.io/docs/releases/2026.5#fixed-in-202657 What's Changed ci: add working dir prefix to file paths (cherry-pick #24319 to version-2026.5) by @authentik-cherry-pick[bot] in #24322 endpoints/connectors/agent: fix auth schema correctly (cherry-pick #24327 to version-2026.5) by @authentik-cherry-pick[bot] in #24330 enterprise/endpoints/connectors/fleet: fix exception when hos…
See https://docs.goauthentik.io/docs/releases/2026.2#fixed-in-202627 What's Changed lifecycle/container: drop curl and runit (cherry-pick #24008 to version-2026.2) by @authentik-cherry-pick[bot] in #24113 policies: filter policy engine (cherry-pick #24025 to version-2026.2) by @authentik-cherry-pick[bot] in #24169 ci: add working dir prefix to file paths (cherry-pick #24319 to version-2026.2) by @…
Changelog Features 8e48365 feat: fall back to user/list_id in WeCom syncer a61599b feat: support department sync in WeCom syncer Bug fixes 311f4d1 fix(auth): drop the panel card on a phone 0b1a605 fix: keep LDAP auto-sync alive after a connection panic e8db3f9 fix: list all organizations' rows when "All" is selected f886a09 fix: report the real reason when uploading users fails 1f86f4c fix: report…
What's Changed feat: in-memory storage parity for the activity-log/rollup contract by @supertokens-agent-runner[bot] in #1380 feat: enforce audited-transaction entry point for domain transactions by @supertokens-agent-runner[bot] in #1382 feat: lifecycle event vocabulary and payload schema for the activity log by @supertokens-agent-runner[bot] in #1381 feat: activity_log retention as a connection-…
Added Adds configurable pipeline optimization for weight-one difference subtract edges with high cardinality on wildcard leaves. For now, this configuration is internal only. #3267 Fixed Fixed validation-ordering defect where malformed RelationReference (relation_or_wildcard oneof set but yielding neither wildcard nor non-empty relation) panicked WriteAuthorizationModel. NewAndValidate now runs al…
What's Changed Added Added WithServiceName server option to allow embedders to override the serviceName field used for the grpc_service label on OpenFGA's package-level Prometheus metrics and telemetry.RPCInfo.Service. This enables multiple Server instances in the same process to emit separate metric series. Note it does not rename the standard gRPC server metrics (e.g. grpc_server_handled_total),…
Feature Flags Custom TargetingTarget feature flags to any resource in your application. Read more
September 8, 2026Feature Flags Custom TargetingTarget feature flags to any resource in your application.Read more
added New Deny All Rule for Tenant ACL You can now configure a Deny All rule within your Tenant Access Control List (ACL) to reject all incoming traffic to your assigned scope. By utilizing the new match_all: true attribute, this rule bypasses specific signal matching (such as IP or geolocation) to apply comprehensive protection across the full tenant scope. When assigned a high priority value, it…
Changelog Features cc39a93 feat(auth): redesign the sign-in, sign-up and forget pages and fix dark mode d353b15 feat: group release notes by commit type Bug fixes 75420fc fix(apple): use the real name from Sign in with Apple as the display name a2fb878 fix(auth): drop the app name heading from the signup and login pages 93cb910 fix(auth): keep the sign-in query string on the forget and organizatio…
What's Changed fix: verify database schema at startup and fail loudly on missing tables/columns by @tamassoltesz in #1387 fix: Fix config updates for CUDs that have multiple tenants by @bcbogdan in #1384 fix: bulk import no longer borrows from the live connection pool by @tamassoltesz in #1385 test: reproduce duplicate access token signing keys on concurrent rotation by @mchoopani in #1389 feat: s…
4.17.3 (2026-09-04) Bug Fixes crypto: use authenticated encryption for IDP intent tokens (41b1114) login: authorize IDP linking via enrollment guard, not isSessionValid (a53fbc4) login: translate authentication and OTP strings (#12668) (739e91e), closes #12481 #12226 security: check auth method permission on the user's organization (20f0984)
MCP Enterprise-Managed Authorization (EMA)Support IDP managed access to your MCP server Read more
September 4, 2026MCP Enterprise-Managed Authorization (EMA)Support IDP managed access to your MCP serverRead more
Dashboard SCIM LogsView your full SCIM request and response payloads from your identity provider directly in the Dashboard to debug provisioning issues. Read more
September 4, 2026Dashboard SCIM LogsView your full SCIM request and response payloads from your identity provider directly in the Dashboard to debug provisioning issues.Read more
Security release. Fixes two reported advisories plus two further issues of the same classes found while fixing them. Upgrading from 2.4.0 is recommended for every deployment. Read the migration note below first — it affects anyone running behind a reverse proxy. Security fixes Issue Severity Affected Admin-secret brute-force lockout bypass via spoofable client IP (GHSA-93hc-xq3w-xw87) Critical >=…
Version 202637added My Organization API and Embeddable UI Components - XAA and third-party app access configuration in Early Acces We're excited to announce that self-service configuration of Third-Party Application Access and Cross App Access (XAA) is now available through the My Organization API and Embeddable UI Components, in Open Early Access. This capability is available to all customers - c…
Version 202636added My Organization API and Embeddable UI Components - XAA and third-party app access configuration in Early Acces We're excited to announce that self-service configuration of Third-Party Application Access and Cross App Access (XAA) is now available through the My Organization API and Embeddable UI Components, in Open Early Access. This capability is available to all customers - c…
Changelog 3659a08 ci: release from a manually pushed tag instead of semantic-release 0c42632 feat: add OIDC provider type babdb25 feat: add a command palette, bulk row selection and inline form validation 7685f8e feat: lay out console forms in two columns and let list tables hide columns bfe0353 feat: let an LDAP server opt in to password reset b6e2abd feat: mark which groups granted each of a use…
Agent AuthGive your AI agents their own identity: secure, scoped, instantly revocable. Read more
September 2, 2026Agent AuthGive your AI agents their own identity: secure, scoped, instantly revocable.Read more
Expanded Audit Log retention periodsYou can now retain Audit Log events for up to 10 years Read more
September 2, 2026Expanded Audit Log retention periodsYou can now retain Audit Log events for up to 10 yearsRead more