4.19.4 (2026-10-01) Bug Fixes actions: set instance ID in async execution worker context (#12730) (03a2469), closes #11985 notification: correct ID order of the invite code sent handler (#12846) (101343a) skip finalized unique-constraint backfill and exclusive owner deletes (#12833) (aee8b88), closes #12831 #12834
4.19.3 (2026-09-29) Performance Improvements query: index users14 by instance and org (#12830) (d378dea), closes #12826 query: stop expanding login names for every ListUsers row (#12826) (2c6acd8), closes #10037 #10840 #11768 #12830
This release fixes three security vulnerabilities. We recommend all 4.x deployments upgrade. Security GHSA-x4c7-fpcx-w9q6 (high): SAML identity-provider confusion leading to account takeover GHSA-jh92-5mrj-p2w2 (high): account takeover through the unsigned Login V2 session cookie GHSA-w4gv-rcwj-w6r5 (low): end-user impersonators could impersonate administrators ⚠️ Upgrade notes for the Login UI (L…
4.19.1 (2026-09-23) Bug Fixes setup step 79 batch unique constraint owner backfill (#12803) (42cdd5d)
⚠️ Please skip this release and use v4.19.0. The setup step fails in this version (issue). 4.18.0 (2026-09-21) Bug Fixes eventstore: add owners to unique constraints (#12740) (c397a60) eventstore: prevent projections from skipping events (#12703) (d49a665), closes #8509 #10480 #10560 #10710 login: forward login_hint to the external IdP (#12760) (482ddc7), closes #6899 #11552 #12080 #12683 login: v…
4.19.0 (2026-09-23) Bug Fixes eventstore: omit owners on empty unique constraint inserts (#12785) (6308539), closes #12740 #12780 #12740 Features eventstore: remove application constraints by app owner (#12798) (765027e)
4.17.3 (2026-09-04) Bug Fixes crypto: use authenticated encryption for IDP intent tokens (41b1114) login: authorize IDP linking via enrollment guard, not isSessionValid (a53fbc4) login: translate authentication and OTP strings (#12668) (739e91e), closes #12481 #12226 security: check auth method permission on the user's organization (20f0984)
4.17.2 (2026-08-31) Bug Fixes api: correct caching and relations of well-known app link files (#12634) (21dbb2e), closes #12580 #12497 api: prevent cross-instance caching of well-known app link files (#12644) (f0329f0), closes #12634 #12634 #12634 #12497 console: support Zitadel Support IDP (#12619) (c543449), closes #11825 #5127 #12018 #12056 #12371 #12378 #12384 #12394 #12396 #12422 #12469 #1253…
3.4.15 (2026-08-14) Bug Fixes command: enforce permission check when issuing passkey enrollment codes (67f9d29) login: require MFA prompt step before 2FA enrollment (d81ab1c)
4.17.1 (2026-08-14) Bug Fixes block Login V2 auth for users in deactivated organizations (a9311b8) command: enforce permission check when issuing passkey enrollment codes (76dd58e) login: prevent the browser from requesting OTP codes via returnCode (5f75afb) login: require MFA prompt step before 2FA enrollment (db42371)
4.17.0 (2026-08-12) Bug Fixes actions: allow adding raw metadata values via appendMetadataRaw (#12567) (c1b9885), closes #10666 #5526 #10470 #5526 allow invite codes for users whose auth methods were all removed (#12453) (eb7af25) api: accept SetSecuritySettings on /v2/settings/security (#12518) (6e07fb7), closes #12313 console: change username abort dialog and set email as verified #10803 #12146…
4.16.3 (2026-08-07) Bug Fixes telemetry: record route patterns instead of request paths on HTTP metrics (#12557) (beffd5e), closes #9286 #9523 #11435 #12315 #12556 #9286 #9523 #11435
3.4.14 (2026-07-29) Bug Fixes login: prevent external-IDP account pre-hijack in Login V1 (da67750) login: require authentication before WebAuthn/U2F and TOTP/OTP enrollment (dd975b8)
4.16.2 (2026-07-29) Bug Fixes improve random string generation (#12266) (34345ea) login: prevent external-IDP account pre-hijack in Login V1 (917ade3) login: redirect to external IdP after domain discovery regardless of registration policy (#12369) (c4ba5a1), closes #12021 #12023 login: require authentication before WebAuthn/U2F and TOTP/OTP enrollment (c20d613) use protected http client for org d…
3.4.13 (2026-07-17) Bug Fixes actions: prevent disk access via require (e28d6bc)
4.16.1 (2026-07-17) Bug Fixes actions: prevent disk access via require (afe1086) console: display minimum length in password complexity message (#12419) (cc3812a), closes #12390 login: keep submit button disabled/loading during password set r… (#12429) (0a355f7), closes #12416 login: prevent crash on a stale session cookie (#12423) (6030a43), closes #11130
4.16.0 (2026-07-10) Bug Fixes correct scope validation in token exchange (#12312) (02d07e9), closes #12319 #12322 #12319 #12322 Correctly remove adjacent roles on user grants (dc89900) increase performance of ListUser by login name ignore case (#12350) (8fed358) login: allow custom protocols for native apps again (#12332) (5b3c10e) login: improve contrast of IDP processing message (#12309) (30ad9a…
4.15.3 (2026-06-22) Bug Fixes added client and scope validation for token exchange (e2886a6) ensure external user's email is verified before auto-linking (c97012f) login: center text for generic IDP buttons without icons (#12211) (aadc664), closes #12182 login: guard defaultRedirectUri in OIDC/SAML FailedPrecondition paths (0382659)
3.4.12 (2026-06-17) Bug Fixes always validate exp and iat claims of JWT IdPs (d1c3aa8) client_id verification during code exchange and refresh token flows (5b1708e) jwt idp: manage and validate audience (42f629d)
4.15.2 (2026-06-17) Bug Fixes always validate exp and iat claims of JWT IdPs (4925fab) client_id verification during code exchange and refresh token flows (5624030) connection handling in setup after migration steps 40, 64 and 70 (#12293) (c53d977) eventstore: allow overwriting resource owner of events (#12261) (a939b84) idp: apply PKCE when building OAuth and OIDC providers (#12247) (ab7c6c0), cl…
4.15.1 (2026-06-08) Bug Fixes api: check permission based on provided data on user updates (a1748b2) login: apply custom request headers from environment variable in proxy (#12144) (aad90ce), closes #12125 login: redirect to email verification when forced MFA has no visible factors (#12060) (9618e33), closes #11536 login: retry logic for session creation after registration on NotFound (#12189) (53…
3.4.11 (2026-06-10) Bug Fixes api: check permission based on provided data on user updates (90f3102)
3.4.10 (2026-05-04) Bug Fixes ldap: escape username filter (59fa301)
4.15.0 (2026-05-04) Bug Fixes console: delete role assignment in admin profile #10376 (#11867) (c1e62e1) console: display actions v1 with correct permissions #12001 (#12068) (1358d08) ldap: escape username filter (a56d4bf) login: lru-cache compatibility, improve session error handling (#12099) (760cd7e) login: resolve localized legal links in signup (#11913) (73f8e28), closes #11907 Features conso…
4.14.0 (2026-04-24) Bug Fixes console: always show settings page to admin (#11779) (2f81454), closes #10912 console: disallow smtp double create #8964 (#11868) (aeddf0e) console: Fix onboarding link for user login guide (#11958) (677450e) console: jwt provider callback urls #11589 (#11966) (bfbf943) console: normalize empty OIDC redirect uri updates #12053 (#12067) (c16667b) console: pass data to…
4.13.1 (2026-04-01) Bug Fixes do not send init mails for admins on instance setup (#11744) (60a4f3b) make recovery code active on add (#11734) (9ac2518) revert feature key for configs back to ConsoleUseV2UserApi (#11928) (7ead851), closes #11390 #11706 use preparation filter for org existence check during setup (#11932) (3ef1593), closes #11677
4.13.0 (2026-03-23) Bug Fixes check whether org exists before creating user (#11647) (ac046ee), closes #11532 console: manager removal #11543 (#11627) (853a253) console: organization column display in grants #10822 (#11742) (7374804) console: role assignment manipulation #10517 (#11756) (88a3c23) console: switch to webkeys v2 (from v2beta) (#11807) (d1230ce), closes #10773 login: disable auto-capi…