Changelog Bug fixes 0feded2 fix: handle missing organization and user in remove-user-from-group API 29c2451 fix: mark JWT-Custom refresh tokens with tokenType refresh-token 0cef429 fix: redirect to the requested page after login 956c405 fix: release camera on unmount and attach video after face dialog mounts 84a262a fix: restrict uploaded groups, roles and permissions to the admin's organization 2…
Changelog Features b94dce9 feat: open account menu on hover bd13018 feat: return stable error code in login failure response Bug fixes 8f7efcf fix: check terms of use by default on login page c92ff2d fix: check terms of use by default on signup page 94c0ef0 fix: end access-token sessions when the token is revoked by SSO logout 51bd444 fix: inherit DCR token lifetimes from the default application a…
Changelog Features c9adca0 feat: add Audit provider to forward audit logs to Syslog Bug fixes 9944731 fix: keep provider host, endpoint and type unchanged on demo database 11f53fb fix: publish all certs in the global JWKS again 153bea5 fix: skip invalid certs instead of failing the whole JWKS fad4d7b fix: treat demo database as demo mode for provider APIs
Changelog Features 9f13005 feat: add application-level token group format option 3377f35 feat: support OIDC prompt=none on the authorize page (#5884) de6fc6d feat: support RFC 9207 iss parameter in authorization responses 980ad12 feat: support max session count for exclusive signin 6c18f6c feat: upgrade React to 19.3.0 in web Bug fixes 91fc924 fix: accept JWT-Standard subject tokens in token excha…
Changelog Bug fixes 1278f9d fix: bind MFA remember to device and block avatar SSRF and forged payment notifies 6179955 fix: block cross-org API permission fallback on empty owner a0701ad fix: harden DCR, session rotation, Kerberos realm and XSS sinks 03c6c9a fix: harden OAuth, MFA, CAS and signup security checks a8f8d56 fix: harden consent, password reset, master code and CAS checks 8b6360b fix: r…
Changelog Features 0f7d684 feat: support SAML Single Logout protocol Bug fixes 3343aa5 fix: authorize session APIs against sessionPkId instead of id b40db12 fix: block cross-org token minting and secret-field query oracles fcc949c fix: enforce MCP token scopes on token-derived session cookies 2b91d9e fix: harden MFA, device flow and cross-org group checks 18b4671 fix: harden credential and session…
Changelog Bug fixes 5b456e1 fix: make account item names selectable in organization edit page 9db04af fix: restore web-old behavior in the console's editable sub-tables 2ad0722 fix: send Vary: Origin from the CORS filter
Changelog Bug fixes eff25f6 fix: allow an org-scoped subject to update its own organization af0b022 fix: attribute audit records of unauthenticated requests to an organization 92c2db6 fix: correct Ukrainian (uk) i18n translations (#5869) 3cd925a fix: default the MFA setup wizard to the organization's required factor 2db20ea fix: don't prefill a random invalid phone number for new users 5370339 fix…
Changelog Features ab56581 feat: add RADIUS Message-Authenticator support with a per-provider switch 72a1d5a feat: add organization-level exclusive signin across applications 0352f4b feat: render the forced password update as a standalone auth page Bug fixes bcd8754 fix: follow the connection's search_path when syncing PostgreSQL tables 30f94bd fix: redirect to the RP on logout even when Casdoor h…
Changelog Features bb76eb6 feat: add magic link sign-in Bug fixes fbcb496 fix: keep empty forceLanguage empty so browser language detection works 0db629e fix: keep resolved RADIUS/push provider id through MFA setup enable step 4684d70 fix: read SAMLRequest case-insensitively in auth callback 91ae9d6 fix: redirect to the single OAuth provider only once instead of on every render 7bf924a fix: reset…
Changelog Features fb38eae feat: add group add/delete actions to group tree page 39a1bba feat: support popup mode for Captcha providers Bug fixes 0f629eb fix: URL-encode OAuth state on interactive login, consent, prompt, signup and post-logout redirects 1d65427 fix: allow only global admins to change applications' custom HTML f82480a fix: allow org admins to import groups, roles and permissions vi…
Changelog Features d60b5ae feat: add configurable password history check e1aa116 feat: add organization-level defaultTokenFields for new applications d6f2cb6 feat: show device, IP and last active time for each session e7f2799 feat: support app-level dark logo fbacaea feat: support group-level subscriptions ed417c1 feat: support invite-only pricing Bug fixes 3eb9231 fix(web): keep draft rows in key…
Changelog Features 8e48365 feat: fall back to user/list_id in WeCom syncer a61599b feat: support department sync in WeCom syncer Bug fixes 311f4d1 fix(auth): drop the panel card on a phone 0b1a605 fix: keep LDAP auto-sync alive after a connection panic e8db3f9 fix: list all organizations' rows when "All" is selected f886a09 fix: report the real reason when uploading users fails 1f86f4c fix: report…
Changelog Features cc39a93 feat(auth): redesign the sign-in, sign-up and forget pages and fix dark mode d353b15 feat: group release notes by commit type Bug fixes 75420fc fix(apple): use the real name from Sign in with Apple as the display name a2fb878 fix(auth): drop the app name heading from the signup and login pages 93cb910 fix(auth): keep the sign-in query string on the forget and organizatio…
Changelog 3659a08 ci: release from a manually pushed tag instead of semantic-release 0c42632 feat: add OIDC provider type babdb25 feat: add a command palette, bulk row selection and inline form validation 7685f8e feat: lay out console forms in two columns and let list tables hide columns bfe0353 feat: let an LDAP server opt in to password reset b6e2abd feat: mark which groups granted each of a use…
4.0.0 (2026-09-01) Features replace the Ant Design console with the shadcn/ui frontend (38ecc6e) BREAKING CHANGES web/ now holds the shadcn/ui frontend built with Vite. Its build output layout changed from create-react-app's build/static/{js,css} to Vite's build/assets/, so anything serving Casdoor's static files through a CDN or a reverse proxy needs its paths updated. The Ant Design frontend is…
3.164.0 (2026-08-30) Features add missing organization segment to syncer add URL (54df9cc)
3.163.3 (2026-08-30) Bug Fixes do not re-init login theme algorithm from localStorage (#5773) (8931d09)
3.163.2 (2026-08-30) Bug Fixes reject duplicate email and phone before sending signup code (44a81f4)
3.163.1 (2026-08-30) Bug Fixes correct Ukrainian (uk) i18n translations (#5775) (bde0144)
3.163.0 (2026-08-28) Features migrate more code to web2 (bb9a309)
3.162.0 (2026-08-28) Features add MFA setup and captcha to web2 (7fb280b)
3.161.1 (2026-08-27) Bug Fixes migrate the frontend from antd to shadcn/ui in web2 (a96940f)
3.161.0 (2026-08-27) Bug Fixes signinMethods "Hide password" rule not enforced server-side (#5762) (dc88244) Features support SAML IdP-initiated SSO (e2dd9bf)
3.160.1 (2026-08-27) Bug Fixes signinMethods "Hide password" rule not enforced server-side (#5762) (2bfc378)
3.160.0 (2026-08-27) Features respect application theme when computing dark mode (dbfe1c6)
3.159.0 (2026-08-25) Features add enableGroups switch to the LDAP edit page (5f08e4c)
3.158.0 (2026-08-22) Features support Alipay open_id when user_id is absent (e6b2338)
3.157.1 (2026-08-22) Bug Fixes fix MCP proxy auth response, upstream token saving and credential leak (1e22a95) return 401 with WWW-Authenticate for MCP proxy requests (dde6d97)
3.157.0 (2026-08-22) Features look up MCP applications under the admin owner (3a868ed)