v4.15.2
Bug fixes including JWT IdP claim validation, client ID verification during OAuth flows, connection handling after migrations, PKCE application for OAuth/OIDC providers, and JWT audience management. Also improves login handling for passkey registration and custom font loading in branding.
4.15.2 (2026-06-17)
Bug Fixes
- always validate exp and iat claims of JWT IdPs (4925fab)
- client_id verification during code exchange and refresh token flows (5624030)
- connection handling in setup after migration steps 40, 64 and 70 (#12293) (c53d977)
- eventstore: allow overwriting resource owner of events (#12261) (a939b84)
- idp: apply PKCE when building OAuth and OIDC providers (#12247) (ab7c6c0), closes #12036 #12054
- jwt idp: manage and validate audience (999e2bb)
- login: accept IDP sessions on passkey registration (#12275) (add46e0)
- login: load custom font from branding settings and allow in CSP (#12279) (9f1561d), closes #11200
- remove unnecessary entry from default denylist (#12294) (1ca1fbd)
- use protected http client for outgoing connections (b6f7808)
Source: original entry ↗
More from ZITADEL
Follow ZITADEL to get its new changes in your feed and email digest.
v4.19.4 Bug Fixes
This release includes bug fixes for the async execution worker context not having the instance ID set, corrects the ID order in the invite code notification handler, and improves handling of finalized unique-constraint backfill and exclusive owner deletes.
Performance improvements for user queries
Improved performance of user listing queries by indexing users by instance and organization, and stopped expanding login names for every ListUsers row to reduce database load.
v4.19.2 – Security fixes for SAML, session cookies, and impersonation
This release fixes three security vulnerabilities including SAML identity-provider confusion leading to account takeover, unsigned Login V2 session cookie vulnerability, and unauthorized administrator impersonation. All 4.x deployments should upgrade and configure the new ZITADEL_SESSION_COOKIE_SECRET for Login V2.