authentik 2023.8.4 → 2026.5.7
95 releases · 83 breaking changes · 106 security fixes · 36 advisories fixed
106security83breaking10deprecated296feature456fix
Vulnerabilities fixed by this upgrade
- 5.4 GHSA-hmrg-vpp4-gj88 Broken access control in Shared Signals Framework stream management
- 8.8 CVE-2026-61574 RAC endpoints and their stored credentials are exposed to any authenticated user, and connections can cross application boundaries
- 8.7 CVE-2026-57580 Account Takeover via SAML NameID Comment Truncation
- 8.6 CVE-2026-54730 Google Chrome device trust stages can be bypassed
- 5.3 CVE-2026-55106 LDAP Source debug endpoint accessible without authorization
- 8.8 CVE-2026-49443 `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API
- 9.8 CVE-2026-49448 SourceStage bypass via empty POST
- 8.5 CVE-2026-47201 XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user
- medium CVE-2026-41569 WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints
- 9.3 CVE-2026-42849 Reflected XSS in SFE
- 8.1 CVE-2026-40172 Privilege Escalation via User PATCH: Superuser Group Assignment Bypasses enable_group_superuser
- 7.4 GHSA-3wf5-rj6w-7527 OAuth2 Redirect URI Poisoning via Auto-Save on Unconfigured Provider
- medium CVE-2026-41577 SAML source does not validate Conditions, timing, or audience on assertions
- high CVE-2026-40166 Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/
- 8.7 GHSA-5wcc-hf24-rf5h Unauthenticated Access via Client-Controlled X-Original-URI Header in Nginx Forward-Auth Mode
- 8.7 CVE-2026-40165 SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation
- 9.1 CVE-2026-25227 Authenticated Remote Code Execution via Policy/Property Mapping test endpoint
- 8.6 CVE-2026-25748 Forward authentication bypass with malformed session cookie on Traefik and Caddy
- 8.8 CVE-2026-25922 Signature Verification bypass in SAML Source Assertion
- 5.8 CVE-2025-64708 Invitation expiry is delayed by at least 5 minutes
- 4.8 CVE-2025-64521 Deactivated service account can authenticate to OAuth
- 7.1 CVE-2025-53942 Insufficient check for account active status when authenticating with OAuth/SAML Sources
- 6.5 CVE-2025-52553 Insufficient Session verification for Remote Access Control endpoint access
- 8.0 CVE-2025-29928 Deletion of sessions did not revoke sessions when using database session storage
- 6.4 CVE-2024-52287 Insufficient validation of OAuth scopes for client_credentials and device_code grants
- 7.9 CVE-2024-52289 Insecure default configuration for OAuth2 Redirect URIs
- 6.3 CVE-2024-52307 Timing attack due to a lack of constant time comparison for metrics view
- 9.0 CVE-2024-47070 Password authentication bypass via X-Forwarded-For HTTP header
- high CVE-2024-47077 Insufficient cross-provider token validation during introspection
- 7.5 CVE-2024-42490 Insufficient Authorization for several API endpoints
- 8.6 CVE-2024-38371 Insufficient access control for OAuth2 Device Code flow
- 8.8 CVE-2024-37905 Improper Authorization for Token modification
- 6.5 CVE-2024-23647 PKCE downgrade attack in authentik
- 7.6 CVE-2024-21637 XSS in Authentik via JavaScript-URI as Redirect URI and form_post Response Mode
- high CVE-2023-48228 OAuth2: Insufficient PKCE check
- 9.6 CVE-2023-46249 Potential Installation takeover when default admin user is deleted
Breaking changes
- breaking website/docs: 2026.5: remove preview tag from mtls stage doc in 2026.5.5
- breaking packages/django-postgres-cache: remove custom get_or_set implementation (cherry-pick #23182 to version-2026.5) in 2026.5.4
- breaking website/docs: remove colons from release notes (cherry-pick #23311 to version-2026.5) in 2026.5.4
- breaking website/docs: sources: remove support_level labels from docs (cherry-pick #23389 to version-2026.5) in 2026.5.4
- breaking providers/ldap: remove incorrect validation for code authenticator extraction (cherry-pick #23006 to version-2026.5) in 2026.5.4
- breaking endpoints: remove print line (cherry-pick #22325 to version-2026.5) in 2026.5.0
- breaking website/integrations: remove sp binding field (cherry-pick #22200 to version-2026.5) in 2026.5.0
- breaking flows: remove link to overview for non-internal user (cherry-pick #22362 to version-2026.5) in 2026.5.0
- breaking providers/ldap: remove incorrect validation for code authenticator extraction (cherry-pick #23006 to version-2026.2) in 2026.2.5
- breaking endpoints: remove print line (cherry-pick #22325 to version-2026.2) in 2026.2.4
- breaking website/docs: remove broken version tag from oauth doc (cherry-pick #21628 to version-2026.2) in 2026.2.3
- breaking website/docs: remove potatoes card sigh (cherry-pick #20767 to version-2026.2) in 2026.2.2
- breaking endpoints: prevent selection of incompatible connector (cherry-pick #20806 to version-2026.2) in 2026.2.2
- breaking providers/proxy: remove redundant logout event (cherry-pick #20860 to version-2026.2) in 2026.2.2
- breaking events: prevent exception when events contains incompatible unicode (cherry-pick #21048 to version-2026.2) in 2026.2.2
- breaking website/docs: remove bad logs redirect (cherry-pick #20522 to version-2026.2) in 2026.2.1
- breaking core: remove superuser check from Token list in 2026.2.0
- breaking website/docs: 2025.12: remove superfluous changes in 2026.2.0
- breaking stages: remove more global state in 2026.2.0
- breaking website/docs: remove duplicates in slo docs in 2026.2.0
- breaking website/docs: remove "beta" tag from 2025.12 in 2026.2.0
- breaking core: remove session migration in 2026.2.0
- breaking web/elements: remove pfbase everywhere in 2026.2.0
- breaking website/docs: Remove stale 2024 version directives in 2026.2.0
- breaking website/docs: remove redundant RC notice in 2026.2.0
- breaking website/docs: remove bad logs redirect (cherry-pick #20522 to version-2025.12) in 2025.12.5
- breaking website/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.12) in 2025.12.3
- breaking website/docs: remove "beta" tag from 2025.12 (cherry-pick #19404 to version-2025.12) in 2025.12.1
- breaking website/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.10) in 2025.10.4
- breaking website/docs: remove broken info box and fix sentence (cherry-pick #17963 to version-2025.10) in 2025.10.2
- breaking cmd/server/healthcheck: remove worker HTTP healthcheck (cherry-pick #18090 to version-2025.10) in 2025.10.2
- breaking outpost: revert breaking signals change (cherry-pick #17847 to version-2025.10) in 2025.10.1
- breaking website/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.8) in 2025.8.6
- breaking policies: remove object pk from authentik_policies_execution_time to reduce cardinality (cherry-pick #16500) in 2025.8.2
- breaking website/docs: remove base providers redirect. (cherry-pick #16576) in 2025.8.2
- breaking tasks: fix status and healthcheck breaking with connection issues (cherry-pick #16504) in 2025.8.2
- breaking website/docs: remove commented out config options (cherry-pick #15064) in 2025.6.2
- breaking website/docs: clarify 2025.4 breaking Reputation changes in 2025.6.0
- breaking website/docs: remove support badge in 2025.6.0
- breaking core: remove OldAuthenticatedSession content type in 2025.6.0
- breaking stages/user_login: remove success message in 2025.6.0
- breaking website/docs: configuration: remove deprecated key for session storage location in 2025.6.0
- breaking website/docs: remove fluff from release notes 2025.6 (cherry-pick #14819) in 2025.6.0
- breaking website/integrations: remove trailing slash from budibase redirect (cherry-pick #14823) in 2025.6.0
- breaking website/docs: remove commented out config options (cherry-pick #15064) in 2025.4.3
- breaking website/docs: clarify 2025.4 breaking Reputation changes (cherry-pick #14284) in 2025.4.2
- breaking core: remove OldAuthenticatedSession content type (cherry-pick #14507) in 2025.4.1
- breaking website/docs: remove mention of wizard in 2025.4.0
- breaking website/docs: remove Enterprise badge from RAC docs in 2025.4.0
- breaking website/docs: fix missing breaking entry for 2025.2 release notes in 2025.4.0
- breaking website: remove images from integrations index page in 2025.4.0
- breaking website/docs: remove Enterprise badge from RAC docs -- again in 2025.4.0
- breaking stages/authenticator_email: remove flaky assertions in 2025.4.0
- breaking website/docs: backup and restore: remove extra period in 2025.4.0
- breaking website: remove the last updated option from footer in 2025.4.0
- breaking website/docs: dev docs: full: remove note on installing shell plugin in 2025.4.0
- breaking website/docs: Remove enterprise badge from Fleet integration in 2025.4.0
- breaking website integrations: actual budget: remove old header and support_level in 2025.4.0
- breaking website: integrations: apache guacamole: remove redirect URI comments in 2025.4.0
- breaking website/docs: remove Enterprise badge from RAC docs (cherry-pick #13069) in 2025.2.1
- breaking website/docs: remove mention of wizard (cherry-pick #13126) in 2025.2.1
- breaking website/docs: fix missing breaking entry for 2025.2 release notes (cherry-pick #13223) in 2025.2.1
- breaking website: remove RC disclaimer for version 2024.10 (cherry-pick #11871) in 2024.10.1
- breaking website/docs: remove � (cherry-pick #11823) in 2024.10.0
- breaking core: remove html language tag for pages that are translated (cherry-pick #10611) in 2024.6.2
- breaking web/flows: remove continue button from AutoSubmit stage (cherry-pick #10253) in 2024.6.2
- breaking website/docs: remove RC disclaimer from 2024.6 release notes (cherry-pick #10245) in 2024.6.1
- breaking web/flows: remove background image link (cherry-pick #10318) in 2024.6.1
- breaking core: remove transitionary old JS urls (cherry-pick #10317) in 2024.6.1
- breaking website/docs: Remove hyphen in read replica in Release Notes (cherry-pick #10178) in 2024.6.0
- breaking website/docs: remove outdated info in 2024.4.0
- breaking website/docs: remove tenants docs from sidebar for now in 2024.4.0
- breaking website/docs: 2024.2: update comment about upgrading to mention breaking changes in 2024.4.0
- breaking website/docs: config: remove options moved to tenants in 2024.4.0
- breaking web/admin: remove enterprise preview banner in 2024.4.0
- breaking website/docs: config: remove options moved to tenants (cherry-pick #8976) in 2024.2.3
- breaking website/docs: add warning about Helm breaking change in 2024.x in 2023.10.2
- breaking website/docs: add missing breaking change due to APPEND_SLASH in 2023.10.2
- breaking flows: remove need for post() wrapper by using dispatch in 2023.10.0
- breaking core: remove celery's duplicate max_tasks_per_child in 2023.10.0
- breaking web: remove ./element⇢./user references in 2023.10.0
- breaking root: remove outdated sponsorship section on readme in 2023.10.0
- breaking providers/scim: remove preview in 2023.10.0
Security changes
- security security: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.5 in 2026.5.7
- security security: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.5 in 2026.5.7
- security security: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.5 in 2026.5.7
- security security: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.5 in 2026.5.7
- security security: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.5 in 2026.5.7
- security security: automated internal backport of patch 1822.sec.patch to authentik-2026.5 in 2026.5.5
- security security: automated internal backport of patch 1817.sec.patch to authentik-2026.5 in 2026.5.5
- security security: automated internal backport of patch 1887.sec.patch to authentik-2026.5 in 2026.5.5
- security security: automated internal backport of patch 1919.sec.patch to authentik-2026.5 in 2026.5.5
- security security: automated internal backport of patch 1934.sec.patch to authentik-2026.5 in 2026.5.5
- security website/docs: document SCIM source trust model and security implications (cherry-pick #22535 to version-2026.5) in 2026.5.4
- security root: Fix SECURITY.md versions (cherry-pick #23370 to version-2026.5) in 2026.5.4
- security website/docs: mark cves CVE-2026-49443 and CVE-2026-49448 (cherry-pick #22808 to version-2026.5) in 2026.5.3
- security root: update security release versions (cherry-pick #22583 to version-2026.5) in 2026.5.2
- security security: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2026.5 in 2026.5.2
- security security: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2026.5 in 2026.5.2
- security security: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2026.5 in 2026.5.2
- security website/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2026.5) in 2026.5.0
- security security: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 1919.sec.patch to authentik-2026.2 in 2026.2.6
- security security: automated internal backport of patch 1822.sec.patch to authentik-2026.2 in 2026.2.6
- security security: automated internal backport of patch 1934.sec.patch to authentik-2026.2 in 2026.2.6
- security security: automated internal backport of patch 1887.sec.patch to authentik-2026.2 in 2026.2.6
- security security: automated internal backport of patch 1817.sec.patch to authentik-2026.2 in 2026.2.6
- security website/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2026.2) in 2026.2.4
- security security: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2026.2 in 2026.2.4
- security security: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2026.2 in 2026.2.4
- security security: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2026.2 in 2026.2.4
- security internal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-42849.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-41577.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-41569.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-40172.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-40166.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-40165.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2026.2 in 2026.2.3
- security security: update policy to include explicit intended functionality (cherry-pick #21308 to version-2026.2) in 2026.2.2
- security security: add item to intended behavior section of security policy (cherry-pick #21430 to version-2026.2) in 2026.2.2
- security core: Update supported versions in SECURITY.md in 2026.2.0
- security security: CVE-2026-25922 (2026.2) in 2026.2.0
- security security: CVE-2026-25748 (2026.2) in 2026.2.0
- security security: CVE-2026-25227 (2026.2) in 2026.2.0
- security website/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2025.12) in 2025.12.6
- security security: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2025.12 in 2025.12.6
- security security: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2025.12 in 2025.12.6
- security security: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2025.12 in 2025.12.6
- security internal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: CVE-2026-41577.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: CVE-2026-40172.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: CVE-2026-40166.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: CVE-2026-40165.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: CVE-2026-42849.sec.patch to authentik-2025.12 in 2025.12.5
- security security: CVE-2026-25922 (2025.12) in 2025.12.4
- security security: CVE-2026-25748 (2025.12) in 2025.12.4
- security security: CVE-2026-25227 (2025.12) in 2025.12.4
- security core: Update supported versions in SECURITY.md (cherry-pick #19385 to version-2025.12) in 2025.12.2
- security security: CVE-2026-25922 (2025.10) in 2025.10.4
- security security: CVE-2026-25748 (2025.10) in 2025.10.4
- security security: CVE-2026-25227 (2025.10) in 2025.10.4
- security security: CVE-2026-25922 (2025.8) in 2025.8.6
- security security: CVE-2026-25748 (2025.8) in 2025.8.6
- security security: CVE-2026-25227 (2025.8) in 2025.8.6
- security root: update security.md with github reporting link (cherry-pick #16332) in 2025.8.2
- security root: fix security.md (cherry-pick #16345) in 2025.8.2
- security security: Bump supported versions (cherry-pick #16261) in 2025.8.0
- security Fixes CVE-2025-53942: Insufficient check for account active status when authenticating with OAuth/SAML Sources in 2025.6.4
- security security: fix CVE-2025-52553 (cherry-pick #15289) in 2025.6.3
- security website/integrations: add push security in 2025.6.0
- security Fixes CVE-2025-53942: Insufficient check for account active status when authenticating with OAuth/SAML Sources in 2025.4.4
- security Fixes CVE-2025-52553: Insufficient Session verification for Remote Access Control endpoint access in 2025.4.3
- security security: fix CVE-2025-29928 in 2025.4.0
- security security: fix CVE-2025-29928 (cherry-pick #13695) in 2025.2.3
- security security: fix CVE-2025-29928 (cherry-pick #13695) in 2024.12.4
- security Fixes CVE-2024-52287: Insufficient validation of OAuth scopes for client_credentials and device_code grants in 2024.10.3
- security Fixes CVE-2024-52307: Timing attack due to a lack of constant time comparison for metrics view in 2024.10.3
- security Note that this security release includes backwards incompatible database changes; see https://docs.goauthentik.io/docs/security/cves/CVE-2024-52289#patches in 2024.10.3
- security security: fix CVE 2024 52287 (cherry-pick #12114) in 2024.10.3
- security Fixes CVE-2024-52287: Insufficient validation of OAuth scopes for client_credentials and device_code grants in 2024.8.5
- security Fixes CVE-2024-52307: Timing attack due to a lack of constant time comparison for metrics view in 2024.8.5
- security Note that this security release includes backwards incompatible database changes; see https://docs.goauthentik.io/docs/security/cves/CVE-2024-52289#patches in 2024.8.5
- security security: fix CVE-2024-47077 (cherry-pick #11535) in 2024.8.3
- security security: fix CVE-2024-47070 (cherry-pick #11536) in 2024.8.3
- security security: fix CVE-2024-47077 (cherry-pick #11535) in 2024.6.5
- security security: fix CVE-2024-47070 (cherry-pick #11536) in 2024.6.5
- security security: fix CVE-2024-42490 (cherry-pick #11022) in 2024.6.4
- security security: update supported versions (cherry-pick #10247) in 2024.6.1
- security security: fix CVE-2024-38371 (cherry-pick #10229) in 2024.6.0
- security security: fix CVE-2024-37905 (cherry-pick #10230) in 2024.6.0
- security security: fix CVE-2024-42490 (cherry-pick #11022) in 2024.4.4
- security security: fix CVE-2024-38371 (cherry-pick #10229) in 2024.4.3
- security security: fix CVE-2024-37905 (cherry-pick #10230) in 2024.4.3
- security Fixes CVE-2024-37905: Improper Authorization for Token modification in 2024.4.2
- security security: fix CVE-2024-38371 (cherry-pick #10229) in 2024.2.4
- security security: fix CVE-2024-37905 (cherry-pick #10230) in 2024.2.4
- security security: fix CVE-2024-23647 (cherry-pick #8345) in 2023.10.7
- security providers/oauth2: fix CVE-2024-21637 (cherry-pick #8104) in 2023.10.6
- security security: fix CVE-2023-48228 (cherry-pick #7666) in 2023.10.4
- security security: fix oobe-flow reuse when akadmin is deleted in 2023.10.2
- security security: fix CVE-2024-23647 (cherry-pick #8345) in 2023.8.7
- security providers/oauth2: fix CVE-2024-21637 (cherry-pick #8104) in 2023.8.6
- security security: fix CVE-2023-48228 (cherry-pick #7666) in 2023.8.5
Deprecations
- deprecated website/docs: deprecate GCDT auth stage in 2026.2.0
- deprecated web/startup: deprecated theme names break theming in 2026.2.0
- deprecated core: add cause to ak_groups deprecation event and logs (cherry-pick #20361 to version-2026.2) in 2026.2.0
- deprecated web/startup: deprecated theme names break theming (cherry-pick #19431 to version-2025.12) in 2025.12.1
- deprecated website/docs: deprecate GCDT auth stage (cherry-pick #19306 to version-2025.12) in 2025.12.0
- deprecated internal: fix go deprecation for +build (cherry-pick #17806 to version-2025.10) in 2025.10.1
- deprecated website/integrations: minio: notice about sso deprecation on CE in 2025.6.0
- deprecated website/docs: in developer docs replace deprecated poetry shell command in 2025.4.0
- deprecated core: bump deprecated from 1.2.14 to v1.2.18 in 2025.4.0
- deprecated website: integrations: apache guacamole: Fix deprecated start-of-doc … in 2025.4.0
Every release in between
otherci: add working dir prefix to file paths (cherry-pick #24319 to version-2026.5)
fixendpoints/connectors/agent: fix auth schema correctly (cherry-pick #24327 to version-2026.5)
fixenterprise/endpoints/connectors/fleet: fix exception when host has no policies (cherry-pick #24355 to version-2026.5)
fixbrands: fix schema for current brand's flags (cherry-pick #24376 to version-2026.5)
othercore: bump library/golang from 1.26.2-trixie to 1.26.5-trixie in /lifecycle/container
otherproviders/scim: ignore key casing in SCIM responses (cherry-pick #24441 to version-2026.5)
othercore: bump django from 5.2.15 to v5.2.16 (cherry-pick #24526 to version-2026.5)
fixfix pipeline for version 2026.5
otherendpoints/agent: return 400 instead of 500 for invalid Platform SSO token requests (cherry-pick #24588 to version-2026.5)
fixendpoints/agent: fix Secure Enclave key dropped on first Platform SSO user registration (cherry-pick #24587 to version-2026.5)
featurewebsite/docs: agent: Add API access scope requirement (cherry-pick #24567 to version-2026.5)
fixproviders/scim: fix scim changed detection for nested attributes (cherry-pick #24332 to version-2026.5)
otherwebsite/docs: correct authentik Agent CLI reference and macOS logging paths (cherry-pick #24605 to version-2026.5)
otherpackages/django-dramatiq-postgres: minor fixes (cherry-pick #23181 to version-2026.5)
fixcore: fix group source connection source object (cherry-pick #24626 to version-2026.5)
otherroot: don't include debug info for rust release profile (cherry-pick #24664 to version-2026.5)
featurewebsite/docs: welcome email notification rule: Add LDAP exception (cherry-pick #24672 to version-2026.5)
featurewebsite/docs: Add feedback from previous agent pr (cherry-pick #24713 to version-2026.5)
fixblueprints: fix mismatched stage name in example 2fa login flow (cherry-pick #24668 to version-2026.5)
featureblueprints: handle invalid yaml, add dry run to apply_blueprint (cherry-pick #24813 to version-2026.5)
fixproviders/oauth2: fix missing authorization event for oauth provider, add tests (cherry-pick #24819 to version-2026.5)
fixweb/flows: fix missing required flag on password input (cherry-pick #24831 to version-2026.5)
fixproviders/scim: fix display of SCIMRequestException (2026.8) (cherry-pick #24833 to version-2026.5)
fixstages/email: fix test_email ignoring the given stage (cherry-pick #25166 to version-2026.5)
featureproviders/radius: allow empty message authenticator (cherry-pick #25097 to version-2026.5)
fixendpoints/connectors: fix integrity error when device with same name exists already (cherry-pick #25237 to version-2026.5)
featurecore: add user type-active-username index (cherry-pick #25223 to version-2026.5)
featurecore: set days=1 as default token duration for new installs (cherry-pick #25341 to version-2026.5)
fixlib/expression: fix policy request context pollution (cherry-pick #25462 to version-2026.5)
fixworker: fix healthcheck paths (cherry-pick #24481 to version-2026.5)
fixtenants/settings: fix flags response (cherry-pick #25616 to version-2026.5)
fixweb/admin: fix schedule form (cherry-pick #25778 to version-2026.5)
securitysecurity: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.5
fixlifecycle: fix server prometheus metrics getting registered early with pid instead of worker ID (cherry-pick #25883 to version-2026.5)
securitysecurity: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.5
featurewebsite/docs: add release notes for 2026.2.7 (cherry-pick #25979 to version-2026.5)
featurewebsite/docs: add release notes for 2026.5.7 (cherry-pick #25980 to version-2026.5)
+21 more items in the release notesotherweb/flow: revert locale-driven flow re-request from FlowExecutor (cherry-pick #24050 to version-2026.5)
otherlifecycle/container: drop curl and runit (cherry-pick #24008 to version-2026.5)
otherenterprise/endpoints/connectors/fleet: pass populate_policies (cherry-pick #24108 to version-2026.5)
otherpackages/django-dramatiq-postgres/broker: use positive state filter for pending messages (cherry-pick #24074 to version-2026.5)
fixendpoints/connectors/agent: fix auth schema for device endpoints (cherry-pick #24164 to version-2026.5)
otherpolicies: filter policy engine (cherry-pick #24025 to version-2026.5)
otherwebsite/docs: cleanup 07-12: refresh contributor guidance (cherry-pick #23969 to version-2026.5)
otherinternal/config: make storage file paths overwritable via env vars (cherry-pick #24177 to version-2026.5)
fixstages/captcha: fix hcaptcha height (#20901)
featureproviders/scim: exclude read-only id from group PATCH payload and fix null-members add check (cherry-pick #23950 to version-2026.5)
fixproviders/scim: fix enum warning when de-serializing (cherry-pick #23553 to version-2026.5)
fixproviders/scim: fix non-schema compliant group member removal (cherry-pick #23800 to version-2026.5)
fixroot: fix make gen-diff command (cherry-pick #22548 to version-2026.5)
othercore: bump pyjwt from 2.11.0 to 2.13.0 (cherry-pick #22562 to version-2026.5)
othercore: Form friendly error on uniqueness constraint. (cherry-pick #23864 to version-2026.5)
fixweb/admin: fix app view failing when no events permissions (cherry-pick #24131 to version-2026.5)
fixroot: fix make gen-changelog (cherry-pick #24122 to version-2026.5)
otherroot: in-process per-IP rate throttle (#23015)
othertests/openid_conformance: migrate to upstream images (cherry-pick #23828 to version-2026.5)
otherendpoints: handle exception in connector controller sync setup (cherry-pick #23852 to version-2026.5)
fixweb/flows: fix race condition in continuous login and support source stages in authentication flows (cherry-pick #23049 to version-2026.5)
fixweb: fix table refresh button not refreshing table data (cherry-pick #23780 to version-2026.5)
featureweb/admin: licensing: add usage totals (cherry-pick #23665 to version-2026.5)
fixweb: Fix Log Viewer Intersection Observer. (cherry-pick #23861 to version-2026.5)
fixstages/email: fix ungrammatical expiry time in password reset templates (cherry-pick #22758 to version-2026.5)
otherwebsite/docs: cleanup 07-12: update integration routes (cherry-pick #23960 to version-2026.5)
otherwebsite/docs: cleanup 07-12: update documentation URLs (cherry-pick #23961 to version-2026.5)
fixwebsite/docs: cleanup 07-12: fix Admin interface tab label (cherry-pick #23965 to version-2026.5)
otherproviders/scim: improve error display when error doesn't conform to scim schema (cherry-pick #23955 to version-2026.5)
fixlib/sync/outgoing: fix discover running for each page (cherry-pick #24016 to version-2026.5)
breakingwebsite/docs: 2026.5: remove preview tag from mtls stage doc
featureapi/search: add number and boolean support in AKQL queries on JSON fields (#23418) (cherry-pick #24028 to version-2026.5)
othersources/oauth: improve id_token validation for apple source (cherry-pick #24017 to version-2026.5)
otherpackages/django-dramatiq-postgres/broker: close unusable PostgreSQL connections (cherry-pick #24023 to version-2026.5)
securitysecurity: automated internal backport of patch 1822.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch 1817.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch 1887.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch 1919.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch 1934.sec.patch to authentik-2026.5
otherwebsite/docs: release notes for 2026.2.6 (cherry-pick #24069 to version-2026.5)
otherwebsite/docs: release notes for 2026.5.5 (cherry-pick #24070 to version-2026.5)
featurewebsite/integrations: dokuwiki: add post logout and logout urls (cherry-pick #22984 to version-2026.5)
otherwebsite/docs: additional scim provider docs (cherry-pick #22135 to version-2026.5)
otherroot: bump pyo3 (cherry-pick #23036 to version-2026.5)
securitywebsite/docs: document SCIM source trust model and security implications (cherry-pick #22535 to version-2026.5)
fixweb: Fix user list default paths. (cherry-pick #23062 to version-2026.5)
fixweb/i18n: Fix stale flow locale, unsynchronized locale selector options (cherry-pick #23007 to version-2026.5)
fixweb: Fix stale clipboard tokens, untranslated labels (cherry-pick #23063 to version-2026.5)
featurewebsite/docs: add Splunk event forwarding docs (cherry-pick #22938 to version-2026.5)
fixcore: fix Invitation Emails Ignoring Selected Template (cherry-pick #23122 to version-2026.5)
otherpackages/django-dramatiq-postgres/broker: purge at start of loop to ensure it runs (cherry-pick #23185 to version-2026.5)
fixweb/stages/identification: Fix passkey autofill dropdown not showing on the identification stage (cherry-pick #23187 to version-2026.5)
fixwebsite/docs: fix broken custom email template example (cherry-pick #23191 to version-2026.5)
breakingpackages/django-postgres-cache: remove custom get_or_set implementation (cherry-pick #23182 to version-2026.5)
otherwebsite: migrate brand assets to pkg (cherry-pick #22336 to version-2026.5)
fixpackages/django-postgres-cache: fix naive datetime warning (cherry-pick #23033 to version-2026.5)
fixpackages/django-dramatiq-postgres/broker: fix race condition in broker causing completed tasks to be repeated (cherry-pick #23218 to version-2026.5)
otherwebsite/docs: improve email authenticator docs (cherry-pick #23226 to version-2026.5)
breakingwebsite/docs: remove colons from release notes (cherry-pick #23311 to version-2026.5)
otherwebsite/docs: clarify user and group filtering on scim provider (cherry-pick #22502 to version-2026.5)
securityroot: Fix SECURITY.md versions (cherry-pick #23370 to version-2026.5)
breakingwebsite/docs: sources: remove support_level labels from docs (cherry-pick #23389 to version-2026.5)
othercore: bump goauthentik/fips-debian and fips-python in /lifecycle/container (cherry-pick #23362 to version-2026.5)
fixwebsite/docs: fix 2026.5 release notes mentioning docker-compose.yml (cherry-pick #23385 to version-2026.5)
featureproviders/scim: allow failures during discovery (cherry-pick #23357 to version-2026.5)
featurewebsite/docs: Add improved akql docs (cherry-pick #22693 to version-2026.5)
otherproviders/scim: account for users with no email during discovery (cherry-pick #23417 to version-2026.5)
fixweb/admin: fix spacing issues in wizard (cherry-pick #23484 to version-2026.5)
otherpolicies: skip cache invalidation on User last_login update (cherry-pick #23159 to version-2026.5)
othertasks: avoid useless query on monitoring_set (cherry-pick #23161 to version-2026.5)
otherpackages/django-postgres-cache: avoid regex queries when listing keys if possible (cherry-pick #23160 to version-2026.5)
otherbrands: select_related models accessed in the hot path (cherry-pick #23162 to version-2026.5)
othersources/ldap: avoid re-creating connections to LDAP server (cherry-pick #23520 to version-2026.5)
fixtasks/schedules: fix paused schedules getting unpaused on startup (cherry-pick #23521 to version-2026.5)
fixproviders/*: fix missing declaration for can_discover for outgoing sync providers (cherry-pick #23035 to version-2026.5)
featurewebsite/docs: add expression policy example for welcome emails on user creation (cherry-pick #23486 to version-2026.5)
featuretasks: add pre_delete for TasksModel to avoid OOM when deleting object with many tasks linked (cherry-pick #23664 to version-2026.5)
breakingproviders/ldap: remove incorrect validation for code authenticator extraction (cherry-pick #23006 to version-2026.5)
featurewebsite/docs: add release notes for 2026.2.5 (cherry-pick #23816 to version-2026.5)
fixweb: Fix outline selector, lack of outline on focused checkboxes. (cherry-pick #23260 to version-2026.5)
fixweb, core: Fix server-side message race condition, type mismatch. (cherry-pick #23151 to version-2026.5)
+17 more items in the release notesotherwebsite/docs: 2026.5.2 release notes (cherry-pick #22721 to version-2026.5)
otherwebsite/docs: 2026.2.4 release notes (cherry-pick #22720 to version-2026.5)
otherwebsite/docs: 2025.12.6 release notes (cherry-pick #22719 to version-2026.5)
otherwebsite/docs: update endpoint SSH docs (cherry-pick #22759 to version-2026.5)
fixtests/e2e: fix proxy tests failing due to in-use port (cherry-pick #22785 to version-2026.5)
fixenterprise/providers/scim: fix interactive OAuth overriding refresh_token (cherry-pick #22858 to version-2026.5)
securitywebsite/docs: mark cves CVE-2026-49443 and CVE-2026-49448 (cherry-pick #22808 to version-2026.5)
featurewebsite/docs: add oidc issuer information (cherry-pick #22556 to version-2026.5)
otherwebsite/docs: update binding wizard labels (cherry-pick #22869 to version-2026.5)
fixweb/admin: fix Docker outpost integration form CA Cert filter (cherry-pick #22863 to version-2026.5)
otherblueprints: handle integrity exception when applying blueprints (cherry-pick #22599 to version-2026.5)
otherwebsite/docs: clean up proxy provider docs (cherry-pick #22870 to version-2026.5)
fixendpoints/connectors/agent: fix exception with invalid auth type (cherry-pick #22943 to version-2026.5)
fixproviders/radius: fix panic in log due to type (cherry-pick #22965 to version-2026.5)
fixwebsite: fix package-lock.json (version-2026.5)
otherweb/polyfill: polyfill customElements.getName for Safari < 17.4 (cherry-pick #22940 to version-2026.5)
othercore: bump django from 5.2.14 to v5.2.15 (cherry-pick #22956 to version-2026.5)
otherproviders/oauth: skip post logout redirect matching if none are saved on the provider (cherry-pick #22718 to version-2026.5)
featurewebsite/docs: add release notes for 2026.5.3 (cherry-pick #22976 to version-2026.5)
fixwebsite/docs: Fix release notes cards (cherry-pick #22554 to version-2026.5)
securityroot: update security release versions (cherry-pick #22583 to version-2026.5)
featureendpoints/connectors/agent: allow federated auth via ssh hostkey lookup (cherry-pick #22594 to version-2026.5)
otherwebsite/docs: Bump package-lock
fixproviders/radius: fix eap debug logging (cherry-pick #22551 to version-2026.5)
fixevents: fix Event.log_deprecation not checking that cause is a string (cherry-pick #22598 to version-2026.5)
fixpackages/ak-common/db: fix conn_max_age causing spinning (cherry-pick #22679 to version-2026.5)
fixpackages/ak-common/db: fix certificates options not allowing file paths (cherry-pick #22680 to version-2026.5)
fixproviders/oauth2: fix session decode when upgrading from 2026.2 (cherry-pick #22684 to version-2026.5)
fixenterprise/providers/scim: fix last_updated for OAuth interactive (cherry-pick #22678 to version-2026.5)
securitysecurity: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2026.5
breakingendpoints: remove print line (cherry-pick #22325 to version-2026.5)
featurewebsite/docs: release notes 2026.5: add section about package reduction (cherry-pick #22308 to version-2026.5)
securitywebsite/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2026.5)
featureenterprise/providers/scim: add support for interactive OAuth2 (cherry-pick #22072 to version-2026.5)
fixwebsite/docs: fix typos and style issues (cherry-pick #22141 to version-2026.5)
otherwebsite/integrations: Update all guides to match auto generated issuer (cherry-pick #22180 to version-2026.5)
breakingwebsite/integrations: remove sp binding field (cherry-pick #22200 to version-2026.5)
fixwebsite/docs: 2026.5 release notes: fix performance improvements wording (cherry-pick #22307 to version-2026.5)
fixweb: Fix issue where default user path is not preferred. (cherry-pick #22139 to version-2026.5)
featurewebsite/docs: Add invitation wizard docs (cherry-pick #22069 to version-2026.5)
otherwebsite/docs, integrations: SAML docs endpoint updates (cherry-pick #22197 to version-2026.5)
featureproviders/saml: Add sls to saml overview (cherry-pick #22183 to version-2026.5)
breakingflows: remove link to overview for non-internal user (cherry-pick #22362 to version-2026.5)
otherenterprise/stages/mtls: freeze time for expired certs (cherry-pick #22411 to version-2026.5)
featurewebsite: Docs and README new screenshots (cherry-pick #22341 to version-2026.5)
otherweb, website: Update name to application dashboard (cherry-pick #22190 to version-2026.5)
otherweb/table: fetch on first render when already visible (cherry-pick #22376 to version-2026.5)
otherwebsite/docs: providers: update UI terms (cherry-pick #22136 to version-2026.5)
otherproviders/saml: Properly import audience from metadata. (cherry-pick #22181 to version-2026.5)
featurewebsite/docs: add integrations to 2026.5 release notes (cherry-pick #22416 to version-2026.5)
otherroot: configure freezegun to exclude cryptography (cherry-pick #22442 to version-2026.5)
featurewebsite/docs: first batch of updates for new Binding wizard (cherry-pick #22393 to version-2026.5)
fixroot: fix gitignore binary paths (cherry-pick #22445 to version-2026.5)
otherenterprise/stages/mtls: attempt fix freezegun (cherry-pick #22474 to version-2026.5)
fixoutposts: fix stale version in OutpostState (cherry-pick #22487 to version-2026.5)
otherwebsite/docs: update saml source to include details on force authenti… (cherry-pick #22488 to version-2026.5)
featurewebsite/docs: add global to values.yaml snippets and update version (cherry-pick #22524 to version-2026.5)
othercore: bump goauthentik/fips-python from 3.14.3-slim-trixie-fips to 3.14.5-slim-trixie-fips in /lifecycle/container (cherry-pick #22518 to version-2026.5)
featurewebsite/docs: release notes: add absorb lms to integrations (cherry-pick #22534 to version-2026.5)
otherproviders/saml: handle XML declarations in unified endpoint (cherry-pick #22455 to version-2026.5)
fixevents: fix certificate typo (cherry-pick #22542 to version-2026.5)
otherwebsite/release: Release notes updates (cherry-pick #22543 to version-2026.5)
otherlifecycle/container: drop curl and runit (cherry-pick #24008 to version-2026.2)
otherpolicies: filter policy engine (cherry-pick #24025 to version-2026.2)
otherci: add working dir prefix to file paths (cherry-pick #24319 to version-2026.2)
fixproviders/scim: fix scim changed detection for nested attributes (cherry-pick #24332 to version-2026.2)
othercore: bump django from 5.2.16 to v5.2.17 (cherry-pick #24793 to version-2026.2)
otherrbac: use constant-time comparison in SecretKeyFilter (cherry-pick #24888 to version-2026.2)
othercore: return the intended status code from error views for all request methods (cherry-pick #24902 to version-2026.2)
otherserver/core: handle unsupported HTTP method (cherry-pick #22498 to version-2026.2)
otherstages/identification: dynamic captcha keys when stage embedded in identification stage (cherry-pick #24079 to version-2026.2)
otherlib: avoid DNS resolution in fqdn_rand (cherry-pick #25728 to version-2026.2)
otherci: bump golangci lint (cherry-pick #25513 to version-2026.2)
securitysecurity: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.2
othertests/openid_conformance: migrate to upstream images (cherry-pick #23828 to version-2026.2)
fixlib/sync/outgoing: fix discover running for each page (cherry-pick #24016 to version-2026.2)
othersources/oauth: improve id_token validation for apple source (cherry-pick #24017 to version-2026.2)
otherpackages/django-dramatiq-postgres/broker: close unusable PostgreSQL connections (cherry-pick #24023 to version-2026.2)
securitysecurity: automated internal backport of patch 1919.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1822.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1934.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1887.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1817.sec.patch to authentik-2026.2
otherwebsite/docs: release notes for 2026.2.6 (cherry-pick #24069 to version-2026.2)
otherwebsite/docs: 2026.2.4 release notes (cherry-pick #22720 to version-2026.2)
otherwebsite/docs: 2025.12.6 release notes (cherry-pick #22719 to version-2026.2)
fixtests/e2e: fix proxy tests failing due to in-use port (cherry-pick #22785 to version-2026.2)
fixweb/admin: fix Docker outpost integration form CA Cert filter (cherry-pick #22863 to version-2026.2)
otherblueprints: handle integrity exception when applying blueprints (cherry-pick #22599 to version-2026.2)
fixendpoints/connectors/agent: fix exception with invalid auth type (cherry-pick #22943 to version-2026.2)
fixproviders/radius: fix panic in log due to type (cherry-pick #22965 to version-2026.2)
othercore: bump django from 5.2.14 to v5.2.15 (cherry-pick #22956 to version-2026.2)
otheradmin/files: sign custom-domain S3 URLs for the final host (cherry-pick #21704 to version-2026.2)
fixpackages/django-postgres-cache: fix naive datetime warning (cherry-pick #23033 to version-2026.2)
fixwebsite/docs: fix 2026.2 release notes docker compose mention take 2 (cherry-pick #23388 to version-2026.2)
otherpolicies: skip cache invalidation on User last_login update (cherry-pick #23159 to version-2026.2)
othertasks: avoid useless query on monitoring_set (cherry-pick #23161 to version-2026.2)
fixpackages/django-dramatiq-postgres/broker: fix race condition in broker causing completed tasks to be repeated (cherry-pick #23218 to version-2026.2)
fixtasks/schedules: fix paused schedules getting unpaused on startup (cherry-pick #23521 to version-2026.2)
otherbrands: select_related models accessed in the hot path (cherry-pick #23162 to version-2026.2)
fixproviders/*: fix missing declaration for can_discover for outgoing sync providers (cherry-pick #23035 to version-2026.2)
othercore: preserve encoded avatar URLs (cherry-pick #23225 to version-2026.2)
fixweb/flows: fix race condition in continuous login and support source stages in authentication flows (cherry-pick #23049 to version-2026.2)
fixweb, core: Fix server-side message race condition, type mismatch. (cherry-pick #23151 to version-2026.2)
fixweb: Fix issue where default user path is not preferred. (cherry-pick #22139 to version-2026.2)
breakingproviders/ldap: remove incorrect validation for code authenticator extraction (cherry-pick #23006 to version-2026.2)
featureproviders/SCIM: Add discover support (cherry-pick #20658 to version-2026.2)
featureproviders/scim: allow failures during discovery (cherry-pick #23357 to version-2026.2)
otherproviders/scim: account for users with no email during discovery (cherry-pick #23417 to version-2026.2)
fixstages/captcha: fix hcaptcha height (#20901) (2026.2)
otherroot: in-process per-IP rate throttle (#23015) (2026.2)
otherci: remove GHA-based cherry-pick (cherry-pick #23801 to version-2026.2)
featurewebsite/docs: add release notes for 2026.2.5 (cherry-pick #23816 to version-2026.2)
breakingendpoints: remove print line (cherry-pick #22325 to version-2026.2)
securitywebsite/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2026.2)
otherenterprise/stages/mtls: freeze time for expired certs (cherry-pick #22411 to version-2026.2)
otherenterprise/stages/mtls: attempt fix freezegun (cherry-pick #22474 to version-2026.2)
fixoutposts: fix stale version in OutpostState (cherry-pick #22487 to version-2026.2)
featurewebsite/docs: add global to values.yaml snippets and update version (cherry-pick #22524 to version-2026.2)
othercore: bump goauthentik/fips-python from 3.14.3-slim-trixie-fips to 3.14.5-slim-trixie-fips in /lifecycle/container (cherry-pick #22518 to version-2026.2)
featureendpoints/connectors/agent: allow federated auth via ssh hostkey lookup (cherry-pick #22594 to version-2026.2)
fixproviders/radius: fix eap debug logging (cherry-pick #22551 to version-2026.2)
fixcore: fix filter_not_expired not accepting positional arguments (2026.2)
otherci: fix docs not having correct js version setup (2026.2)
fixtenants: fix test teardown (version-2026.2)
securitysecurity: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2026.2
othercore: bump django from v5.2.12 to 5.2.13 (cherry-pick #21520 to version-2026.2)
fixendpoints: fix tasks failing (cherry-pick #20904 to version-2026.2)
featurewebsite/docs: add another sentence to First Steps about restricting access to apps (cherry-pick #21517 to version-2026.2)
otherlib/sync/outgoing: avoid expensive query to get number of sync pages (cherry-pick #21575 to version-2026.2)
otherpackages/django-dramatiq-postgres: reset db connections in raise_connection_error (cherry-pick #21577 to version-2026.2)
fixproviders/oauth2: fix time logic in refresh_token_threshold (cherry-pick #21537 to version-2026.2)
fixblueprints: fix reconcile calling @property (cherry-pick #21576 to version-2026.2)
featurewebsite/docs: add a single page about our user interface, document Consent stage (cherry-pick #20533 to version-2026.2)
breakingwebsite/docs: remove broken version tag from oauth doc (cherry-pick #21628 to version-2026.2)
otherweb/flows: prevent leader tab deadlock in continuous login flow (cherry-pick #21583 to version-2026.2)
featureproviders/oauth2: allow cross provider token introspection for federated providers (cherry-pick #21513 to version-2026.2)
otherproviders/oauth2: don't auto-set redirect_uri (cherry-pick #21746 to version-2026.2)
otherci: fix postgres path for postgres 18 tests (2026.2) (#21767)
featurewebsite/docs: add authorization header info to all proxy configs (cherry-pick #21664 to version-2026.2)
otherproviders/oauth2: clip device authorization scope against the provider's ScopeMapping set (cherry-pick #21701 to version-2026.2)
otherwebsite/docs: improve social login docs titles (cherry-pick #21816 to version-2026.2)
fixproviders/radius: fix message authenticator validation (cherry-pick #21824 to version-2026.2)
otherweb/packages: Rework SFE rendering (cherry-pick #21833 to version-2026.2)
fixcore: fix search for app entitlements failing (cherry-pick #21944 to version-2026.2)
otherrbac: ensure migration 0056 runs before 0010 removes group field (cherry-pick #21964 to version-2026.2)
otherroot: update django to 5.2.14 (cherry-pick #22064 to version-2026.2)
otherpackages/django-dramatiq-postgres/broker: avoid task processing stopping on decode error (cherry-pick #22110 to version-2026.2)
othertenants/settings: present unset flags as False (cherry-pick #22162 to version-2026.2)
fixevents: fix destination_group_obj not being nullable (cherry-pick #22161 to version-2026.2)
fixinternal: fix lint
securityinternal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-42849.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-41577.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-41569.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-40172.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-40166.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-40165.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2026.2
otherwebsite/docs: release notes for 2025.12.5 and 2026.2.3 (cherry-pick #22310 to version-2026.2)
otherci: fix reason change in versions repo bump (cherry-pick #20696 to version-2026.2)
otherweb/admin: bad width on policy test results (cherry-pick #20668 to version-2026.2)
otherweb/flows: continuous login (cherry-pick #19862 to version-2026.2)
othercore: bump django from 5.2.11 to 5.2.12 (cherry-pick #20719 to version-2026.2)
otherlifecycle: make gunicorn --max-requests configurable (cherry-pick #20736 to version-2026.2)
otherpackages/django-channels-postgres: provide sync API for group_send (cherry-pick #20740 to version-2026.2)
breakingwebsite/docs: remove potatoes card sigh (cherry-pick #20767 to version-2026.2)
otherwebsite: override DocSearch button colors in light mode (cherry-pick #20770 to version-2026.2)
fixproviders/scim: fix out-of-scope users and groups not being deleted from destination application (cherry-pick #20742 to version-2026.2)
otherproviders/oauth2: decode percent-encoded basic auth (cherry-pick #20779 to version-2026.2)
otherweb/rbac: disambiguate duplicate permission names in initial permissions (cherry-pick #20786 to version-2026.2)
breakingendpoints: prevent selection of incompatible connector (cherry-pick #20806 to version-2026.2)
otherwebsite/docs: update agent docs (cherry-pick #20782 to version-2026.2)
breakingproviders/proxy: remove redundant logout event (cherry-pick #20860 to version-2026.2)
fixweb/admin: Fix SCIM page_size UI issue (cherry-pick #20890 to version-2026.2)
featurelifecycle/migrate: add flag to skip migrations (cherry-pick #20863 to version-2026.2)
fixweb/admin: fix missing OSM referrerPolicy header (cherry-pick #20984 to version-2026.2)
fixwebsite/docs: fix notification transport etc (cherry-pick #20982 to version-2026.2)
fixwebsite/docs: fix swapped sidebar label (cherry-pick #21011 to version-2026.2)
fixsources/ldap: fix incorrect error response for invalid sync_users_password (cherry-pick #21016 to version-2026.2)
featureenterprise/endpoints/connectors/agent: add login_hint support for interactive auth (cherry-pick #20647 to version-2026.2)
fixweb/admin: handle non-string values in formatUUID to prevent Event Log crash (cherry-pick #20804 to version-2026.2)
breakingevents: prevent exception when events contains incompatible unicode (cherry-pick #21048 to version-2026.2)
featurewebsite/docs: add missing dependencies for linux dev environment (cherry-pick #21020 to version-2026.2)
featureproviders/proxy: Add a default maxResponseBodySize to Traefik Middleware (cherry-pick #21111 to version-2026.2)
fixendpoints/connectors: fix enabled flag not respected (cherry-pick #21144 to version-2026.2)
featureweb/applications: add wsfed to app wizard (cherry-pick #20880 to version-2026.2)
featuresources/oauth: Allow patching without provider type (cherry-pick #21211 to version-2026.2)
fixsources/ldap: fix exception in ldap debug endpoint (cherry-pick #21219 to version-2026.2)
featurewebsite/docs: ad source: add note about ldap signing (cherry-pick #21274 to version-2026.2)
fixcore: fix provider not nullable (cherry-pick #21275 to version-2026.2)
fixproviders/saml: Fix redirect for saml slo (cherry-pick #21258 to version-2026.2)
featurewebsite/docs: add example recovery flow with MFA (cherry-pick #19497 to version-2026.2)
featurewebsite/docs: entra scim: add note about validator (cherry-pick #21273 to version-2026.2)
securitysecurity: update policy to include explicit intended functionality (cherry-pick #21308 to version-2026.2)
fixroot: fix compose generation for patch releases release candidates (cherry-pick #21353 to version-2026.2)
fixinternal: fix certificate fallback without SNI (cherry-pick #21417 to version-2026.2)
fixwebsite/docs: fix merge conflict
securitysecurity: add item to intended behavior section of security policy (cherry-pick #21430 to version-2026.2)
featuretasks: allow retry for rejected tasks only (cherry-pick #21433 to version-2026.2)
+24 more items in the release notesotherwebsite/docs: update supported versions (cherry-pick #20534 to version-2026.2)
fixwebsite/docs: fix upgrade link in 2026.2 release notes (cherry-pick #20539 to version-2026.2)
breakingwebsite/docs: remove bad logs redirect (cherry-pick #20522 to version-2026.2)
otherwebsite/docs: revamp enterprise section (cherry-pick #20379 to version-2026.2)
otherdocs: fix typos and wording in docs and integrations (cherry-pick #20550 to version-2026.2)
otherci: add reason change to versions repo bump (cherry-pick #20562 to version-2026.2)
otherinternal: make http timeouts configurable (cherry-pick #20472 to version-2026.2)
otherpackages/django-dramatiq-postgres: use fork (cherry-pick #20606 to version-2026.2)
fixweb/flows: fix source icons being always inverted (cherry-pick #20419 to version-2026.2)
fixcrypto: fix kid legacy signal (cherry-pick #20627 to version-2026.2)
featuresources/ldap: add connection logging & downgrade message (cherry-pick #20519 to version-2026.2)
fixpackages/django-dramatiq-postgres: fix worker startup on macos (cherry-pick #20637 to version-2026.2)
fixenterprise/wsfed: Fix metadata export and signing logic (cherry-pick #20643 to version-2026.2)
featurewebsite/docs: entra id provider: add custom email domain info (cherry-pick #20444 to version-2026.2)
featurewebsite/docs: kerberos: add note about caching (cherry-pick #20663 to version-2026.2)
fixcore: fix get_provider returning base Provider instead of subclass (cherry-pick #19064 to version-2026.2)
otherpackages/django-channels-postgres: eagerly delete messages (cherry-pick #20687 to version-2026.2)
otheroutpost/proxyv2: prevent panic in handleSignOut (cherry-pick #20097 to version-2026.2)
featurewebsite/docs: add 2025 pentest (cherry-pick #20626 to version-2026.2)
fixweb: fix identification stage styling in compatibility mode (cherry-pick #20684 to version-2026.2)
otherproviders/proxy: move search path to query instead of runtime parameter (cherry-pick #20662 to version-2026.2)
featurewebsite/docs: add release notes for 2026.2.1 (cherry-pick #20659 to version-2026.2)
featureroot: Add macOS support for sed in Makefile
featurewebsite/docs: add icon info to style guide
breakingcore: remove superuser check from Token list
featureadmin/files: revert add check for /media existence (#18636)
featurewebsite/docs: add jellyseer integration doc
featurecore: add skip s3_test_server_available to TestResolveFileUrlS3Backend
featurewebsite/docs: Add docs for passkey autofill (WebauthN Conditional UI)
featureweb: add custom message with links for empty data export list
featureweb/admin: endpoint: change wording and add helper text
featurewebsite/docs: added list of Int Guide contributors (also edited frontmatter)
breakingwebsite/docs: 2025.12: remove superfluous changes
featureweb/admin: add UI copy to RBAC modal
breakingstages: remove more global state
featurewebsite/integrations: Add launch URL for Immich
featurewebsite/docs: release notes: add endpoint device links to 2025.12 notes
featurewebsite/docs: add note to active directory source doc
featureblueprints: add InternallyManagedMixin instead of large list
featureenterprise/search: add static autocomplete structure
featurewebsite/integrations: Add Wallos
featuretests/e2e: add endpoint tests
featurewebsite/docs: rel notes .12: add wallos
featurewebsite/docs: endpoint devices: add path to macos setup
featurewebsite/integrations: Add Pulse
featurewebsite/integrations: Add Audiobookshelf
featurewebsite/docs: release notes: Add more integrations
featurewebsite/integrations: vaultwarden: add custom email scope
featureweb/admin: adjust sync threshold, add tooltip
breakingwebsite/docs: remove duplicates in slo docs
deprecatedwebsite/docs: deprecate GCDT auth stage
securitycore: Update supported versions in SECURITY.md
breakingwebsite/docs: remove "beta" tag from 2025.12
breakingcore: remove session migration
deprecatedweb/startup: deprecated theme names break theming
breakingweb/elements: remove pfbase everywhere
breakingwebsite/docs: Remove stale 2024 version directives
breakingwebsite/docs: remove redundant RC notice
securitysecurity: CVE-2026-25922 (2026.2)
securitysecurity: CVE-2026-25748 (2026.2)
securitysecurity: CVE-2026-25227 (2026.2)
deprecatedcore: add cause to ak_groups deprecation event and logs (cherry-pick #20361 to version-2026.2)
+722 more items in the release notessecuritywebsite/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2025.12)
otherenterprise/stages/mtls: freeze time for expired certs (cherry-pick #22411 to version-2025.12)
otherroot: configure freezegun to exclude cryptography (cherry-pick #22442 to version-2025.12)
otherenterprise/stages/mtls: attempt fix freezegun (cherry-pick #22474 to version-2025.12)
fixoutposts: fix stale version in OutpostState (cherry-pick #22487 to version-2025.12)
otherci: fix docs not having correct js version setup (2025.12)
fixtenants: fix test teardown (version-2025.12)
securitysecurity: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2025.12
securitysecurity: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2025.12
securitysecurity: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2025.12
otherwebsite/docs: 2025.10.4 release notes (cherry-pick #20242 to version-2025.12)
otherwebsite/docs: 2025.12.4 release notes (cherry-pick #20226 to version-2025.12)
otherwebsite/docs: 2025.8.6 release notes (cherry-pick #20243 to version-2025.12)
otherci: fix binary outpost build on release (cherry-pick #20248 to version-2025.12)
featurewebsite/docs: add okta source doc (cherry-pick #20296 to version-2025.12)
otherroot: do not rely on npm cli for version bump (cherry-pick #20276 to version-2025.12)
otherci: fix setup altering package-lock (cherry-pick #20348 to version-2025.12)
otherwebsite/docs: Custom CSS (cherry-pick #19991 to version-2025.12)
fixweb: Fix locale selector in compatibility mode. (cherry-pick #19946 to version-2025.12)
othersources/saml: update handling statusmessage (cherry-pick #19739 to version-2025.12)
fixwebsite/docs: Fix broken link to flow executor (cherry-pick #20364 to version-2025.12)
otherci: pull latest changes before tagging new version (cherry-pick #20413 to version-2025.12)
otherwebsite/docs: rac: update rac provider docs (cherry-pick #20225 to version-2025.12)
fixwebsite/docs: fix GitHub social-login wording and capitalization (cherry-pick #20489 to version-2025.12)
featureenterprise: add ES384 to enterprise license algorithms (cherry-pick #20507 to version-2025.12)
fixendpoints: fix infinite recursion in stage with unsupported connector (cherry-pick #20485 to version-2025.12)
fixwebsite/docs: fix linux setup docs (cherry-pick #20508 to version-2025.12)
fixpolicies: fix PolicyEngineMode ALL with static binding optimization (cherry-pick #20430 to version-2025.12)
breakingwebsite/docs: remove bad logs redirect (cherry-pick #20522 to version-2025.12)
fixweb/sfe: bug: polyfill needed to supply Object.assign() to IE11. (cherry-pick #20126 to version-2025.12)
featurewebsite/docs: kerberos: add note about caching (cherry-pick #20663 to version-2025.12)
fixweb/admin: Fix SCIM page_size UI issue (cherry-pick #20890 to version-2025.12)
featureweb/flows: add continuous flow 2025.12
fixweb/admin: fix missing OSM referrerPolicy header (cherry-pick #20984 to version-2025.12)
fixweb/admin: handle non-string values in formatUUID to prevent Event Log crash (cherry-pick #20804 to version-2025.12)
fixsources/ldap: fix exception in ldap debug endpoint (cherry-pick #21219 to version-2025.12)
featurewebsite/docs: add example recovery flow with MFA (cherry-pick #19497 to version-2025.12)
fixroot: fix compose generation for patch releases release candidates (cherry-pick #21353 to version-2025.12)
fixproviders/saml: Fix redirect for saml slo (cherry-pick #21258 to version-2025.12)
featureproviders/oauth2: allow cross provider token introspection for federated providers (cherry-pick #21513 to version-2025.12)
fixproviders/radius: fix message authenticator validation (cherry-pick #21824 to version-2025.12)
fixweb: Fix duplicate Turnstile widgets after extended idle (cherry-pick #21380 to version-2025.12)
fixinternal: fix lint (cherry-pick #22263 to version-2025.12)
securityinternal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: CVE-2026-41577.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: CVE-2026-40172.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: CVE-2026-40166.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: CVE-2026-40165.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: CVE-2026-42849.sec.patch to authentik-2025.12
+23 more items in the release notesfeaturewebsite/docs: Add changes in 2025.12.2 and 2025.12.3 to the release notes (cherry-pick #19949 to version-2025.12)
fixweb/admin: fix default binding order (cherry-pick #19943 to version-2025.12)
otherproviders/oauth2: use compare_digest for client_secret comparison (cherry-pick #19979 to version-2025.12)
otherrecovery: consume token in transaction (cherry-pick #19967 to version-2025.12)
othercore: bump django from 5.2.10 to 5.2.11 (cherry-pick #19988 to version-2025.12)
fixoutposts: fix docker_tls created files permission (cherry-pick #19978 to version-2025.12)
fixwebsite/docs: fix typos (cherry-pick #20000 to version-2025.12)
otherwebsite/docs: endpoint devices: more updates (cherry-pick #19971 to version-2025.12)
otherwebsite/docs: endpoint devices: specify name and slug (cherry-pick #20016 to version-2025.12)
fixwebsite/docs: endpoint devices: fix non debian wording (cherry-pick #20046 to version-2025.12)
otherdocs: add instructions for configuring rp-initiated single logout (cherry-pick #20040 to version-2025.12)
otherwebsite: QL Search keyboard interactions docs, examples. (cherry-pick #16259 to version-2025.12)
otherwebsite/docs: automated install: mention no file:// vars (cherry-pick #20043 to version-2025.12)
otheroutpost/proxyv2: revalidate auth if session fails to load (cherry-pick #18063 to version-2025.12)
otherwebsite/docs: capturing outpost logs (cherry-pick #20045 to version-2025.12)
otherwebsite/docs: endpoint devices: update device authentication location (cherry-pick #20049 to version-2025.12)
otherwebsite/docs: generate CVE sidebar (cherry-pick #20098 to version-2025.12)
fixsources/oauth: Fix InvalidAudienceError in id_token fallback (cherry-pick #20096 to version-2025.12)
featurewebsite/docs: add email verification scope doc (cherry-pick #20141 to version-2025.12)
fixwebsite/docs: rac: fixes the property mapping formatting (cherry-pick #20200 to version-2025.12)
otherwebsite/docs: ssf: update SSF documentation (cherry-pick #20195 to version-2025.12)
securitysecurity: CVE-2026-25922 (2025.12)
securitysecurity: CVE-2026-25748 (2025.12)
securitysecurity: CVE-2026-25227 (2025.12)
otherweb: updated package-lock.json to include missing tree-sitter references (cherry-pick #20244 to version-2025.12)
feature2025.12: Revert bulk revoke added by accident in release branch
fixweb/admin: fix toggle-group for bindings now showing up (cherry-pick #19820 to version-2025.12)
breakingwebsite/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.12)
fixweb: fix Brand CSS not applied to nested Shadow DOM components (cherry-pick #19892 to version-2025.12)
otherci: always generate API clients (#19906)
otherlifecycle/ak: make sure /data has the correct permissions (cherry-pick #19935 to version-2025.12)
featurelifecycle/aws: add /data volume (cherry-pick #19936 to version-2025.12)
otherwebsite/docs: Update location of media storage and outdated references (cherry-pick #19885 to version-2025.12)
fixcore: fix non-expiring service accounts and app passwords (cherry-pick #19913 to version-2025.12)
otherwebsite/docs: release notes: Update release notes for version 2025.12.1 (cherry-pick #19502 to version-2025.12)
featuresources/kerberos: update to new python-kadmin-rs (cherry-pick #19491 to version-2025.12)
featuretests/e2e: Add delay and serialized rollback to saml e2e test (cherry-pick #18840 to version-2025.12)
otherwebsite/docs: endpoint devices: update device code flow instructions (cherry-pick #19528 to version-2025.12)
fixadmin/files: fix manageable check blocking file creation on fresh installs (cherry-pick #19547 to version-2025.12)
fixadmin/files: fix duplicate bucket name in presigned URLs with custom domain (cherry-pick #19537 to version-2025.12)
securitycore: Update supported versions in SECURITY.md (cherry-pick #19385 to version-2025.12)
featurewebsite/docs: add s3 perms (cherry-pick #19579 to version-2025.12)
otherweb: update @goauthentik/api (cherry-pick #19542 to version-2025.12)
fixweb/forms: fix invalid date error for empty datetime-local inputs (cherry-pick #19561 to version-2025.12)
fixendpoints: fix endpoints stage marked as enterprise (cherry-pick #19607 to version-2025.12)
fixpolicies: fix Providers authentication_flow not used when set (cherry-pick #19609 to version-2025.12)
fixproviders/saml: fix structure of encrypted saml assertion (cherry-pick #19592 to version-2025.12)
featureproviders/saml: allow encryption certificates without private keys (cherry-pick #19526 to version-2025.12)
fixsources/saml: Fix signature verification order to accommodate encrypted assertions (cherry-pick #19593 to version-2025.12)
othertests: improve e2e/integration test reliability (cherry-pick #19540 to version-2025.12)
otherlib/sync/outgoing: handle deletions even if object does not exist in database (cherry-pick #18968 to version-2025.12)
otherwebsite/docs: endpoints devices: typo fix (cherry-pick #19621 to version-2025.12)
fixweb/user: fix Firefox for Android infinite render loop in user library (cherry-pick #19379 to version-2025.12)
fixweb/maintenance: fix missing custom web component imports (cherry-pick #18942 to version-2025.12)
otherwebsite/docs: Update saml google workspace guide (cherry-pick #19624 to version-2025.12)
otherwebsite/docs: update endpoint agent windows log location (cherry-pick #19645 to version-2025.12)
featureproviders/oauth2: add logout+jwt token type for oidc logout token. (cherry-pick #19554 to version-2025.12)
fixweb/forms: fix forms not resetting state when modal closes (cherry-pick #19562 to version-2025.12)
fixweb/admin: fix brand form sending "undefined" string for blank default application (cherry-pick #19658 to version-2025.12)
fixinternal: fix incorrect metric calculation (cherry-pick #19701 to version-2025.12)
featuresources/oauth: add fallback for id_token when profile URL is not available (cherry-pick #19311 to version-2025.12)
fixweb/admin: fix impersonation form requesting data without being opened (cherry-pick #19673 to version-2025.12)
featureweb/sfe: downgrade bootstrap, add access denied test (cherry-pick #19763 to version-2025.12)
fixwebsite/docs: fix Transifex link in translation guide (cherry-pick #19735 to version-2025.12)
fixwebsite/docs: endpoint devices: fix local device login (cherry-pick #19698 to version-2025.12)
fixwebsite/docs: Fix authenticator sms docs (cherry-pick #19797 to version-2025.12)
fixproviders/scim: fix email validation mismatch (cherry-pick #19848 to version-2025.12)
fixsources/oauth: Fix an issue where wechat may crash duing login. (cherry-pick #18973 to version-2025.12)
featurewebsite/docs: add more info to entra id scim doc (cherry-pick #19849 to version-2025.12)
featurewebsite/docs: add tip for recovering from accidental main branch work (cherry-pick #19865 to version-2025.12)
featureadmin/files: add centralized theme variable support for file URLs (cherry-pick #19657 to version-2025.12)
fixweb/admin: fix file upload not preserving extension for custom names with dots (cherry-pick #19548 to version-2025.12)
fixweb/admin: fix captcha stage provider selector not showing saved value (cherry-pick #19555 to version-2025.12)
featurewebsite/docs: endpoint devices: add version command (cherry-pick #19767 to version-2025.12)
+14 more items in the release notesbreakingwebsite/docs: remove "beta" tag from 2025.12 (cherry-pick #19404 to version-2025.12)
fixoutposts/ldap: fix build
featurewebsite/docs: add import to discord policy (cherry-pick #19397 to version-2025.12)
otherwebsite/docs: mention dynamic overrides in redirect stage documentation (cherry-pick #19368 to version-2025.12)
otherwebsite/docs: update gws provider docs (cherry-pick #18286 to version-2025.12)
deprecatedweb/startup: deprecated theme names break theming (cherry-pick #19431 to version-2025.12)
otherci: fix checkout stable (for 2025.12) (#19448)
featureproviders/oauth2: allow property mappings to override scope claim in access tokens (cherry-pick #19226 to version-2025.12)
othercore: bump aiohttp from 3.13.2 to v3.13.3 (cherry-pick #19257 to version-2025.12)
otherendpoints/connectors/agent: Skip Endpoint stage on device IA & fix confusing identification subtext (cherry-pick #19482 to version-2025.12)
otherwebsite/docs: limiting permissions of AD service account (cherry-pick #19483 to version-2025.12)
featureendpoints/connectors/agent: add tests for IA endpoint stage (cherry-pick #19487 to version-2025.12)
otherweb: Z-Index Fixes, Mobile Sidebar Behavior. (cherry-pick #19460 to version-2025.12)
fixweb/admin: fix switches (cherry-pick #19493 to version-2025.12)
otherendpoints: include license status in agent config (cherry-pick #19227 to version-2025.12)
otherwebsite/docs: revisit endpoint docs the nth (cherry-pick #19116 to version-2025.12)
otherwebsite/glossary: improve (cherry-pick #18969 to version-2025.12)
fixcore: fix read replica routing during transactions (cherry-pick #19086 to version-2025.12)
otherstages/authenticator_static: set max token length to 100 chars (cherry-pick #19162 to version-2025.12)
fixwebsite: Fix typos. (cherry-pick #19243 to version-2025.12)
otherstages/prompt: optimize API endpoints (cherry-pick #19251 to version-2025.12)
otherstages/password: replace session-based retries with reputation (cherry-pick #18643 to version-2025.12)
featureweb/admin: add banner to flow import form (cherry-pick #19288 to version-2025.12)
othercore: bump urllib3 from 2.5.0 to v2.6.3 (cherry-pick #19287 to version-2025.12)
othercore: bump django from v5.2.9 to 5.2.10 (cherry-pick #19290 to version-2025.12)
otherwebsite/docs: update entra id provider docs (cherry-pick #18366 to version-2025.12)
deprecatedwebsite/docs: deprecate GCDT auth stage (cherry-pick #19306 to version-2025.12)
otherwebsite/docs: update m2m doc (cherry-pick #18963 to version-2025.12)
fixwebsite/docs: Fix documentation example for app_entitlements_attributes. (cherry-pick #19316 to version-2025.12)
featurewebsite/docs: add flow import warnings (cherry-pick #19307 to version-2025.12)
fixwebsite/docs: Fix typo in GitHub OAuth Source instructions (cherry-pick #18936 to version-2025.12)
fixweb: Fix flow inspector advancement event. (cherry-pick #19309 to version-2025.12)
otherwebsite/docs: update github social login script example (cherry-pick #19246 to version-2025.12)
otherwebsite/docs: update unique email policy (cherry-pick #19305 to version-2025.12)
otherweb: Images styles, theming (cherry-pick #19233 to version-2025.12)
otherwebsite/docs: update LDAP provider docs (cherry-pick #18272 to version-2025.12)
otherpackages/django-dramatiq-postgres: broker: empty message after task completed successfully (cherry-pick #19340 to version-2025.12)
otherweb/admin: always retrieve selected provider when editing the application (cherry-pick #19341 to version-2025.12)
otherweb/elements: hidden secrets not propagating (cherry-pick #19029 to version-2025.12)
fixoutpost/proxyv2: fix stale session cookie causing 400 error in createState (cherry-pick #19026 to version-2025.12)
otherwebsite/docs: update location for logs on windows (cherry-pick #19371 to version-2025.12)
otherinternal/outpost: improve PostgreSQL connection options parsing (cherry-pick #19118 to version-2025.12)
otherweb: Flow info, localization, back button. (cherry-pick #19234 to version-2025.12)
otherstages/authenticator_validate: decrease reputation on failed MFA attempt (cherry-pick #19378 to version-2025.12)
otherinternal: rework liveness probe and proxy (cherry-pick #19312 to version-2025.12)
otherweb: UI Locale Fixes (cherry-pick #19235 to version-2025.12)
fixweb/flow: Fix spurious double submit on ak-stage-autosubmit (cherry-pick #18727 to version-2025.10)
featurewebsite/docs: add note to active directory source doc (cherry-pick #18787 to version-2025.10)
otherwebsite/docs: Backport version picker updates. (cherry-pick #18964 to version-2025.10)
fixweb/admin: fix dark theme on map (cherry-pick #18985 to version-2025.10)
fixweb/admin: Fix haveibeenpwned link in PasswordPolicyForm (cherry-pick #18984 to version-2025.10)
othercore: use chunked_queryset for expired message deletion (cherry-pick #19028 to version-2025.10)
otherinternal: update TLS Suite (cherry-pick #19076 to version-2025.10)
fixwebsite/docs: fix build (cherry-pick #19148 to version-2025.10)
fixweb: fix slug auto-updating when editing existing applications (cherry-pick #19169 to version-2025.10)
fixcore: fix read replica routing during transactions (cherry-pick #19086 to version-2025.10)
featureweb/admin: add banner to flow import form (cherry-pick #19288 to version-2025.10)
otherwebsite/docs: update entra id provider docs (cherry-pick #18366 to version-2025.10)
fixwebsite/docs: Fix typo in GitHub OAuth Source instructions (cherry-pick #18936 to version-2025.10)
fixwebsite/docs: Fix documentation example for app_entitlements_attributes. (cherry-pick #19316 to version-2025.10)
otherwebsite/docs: update m2m doc (cherry-pick #18963 to version-2025.10)
otherwebsite/docs: update LDAP provider docs (cherry-pick #18272 to version-2025.10)
otherweb/elements: hidden secrets not propagating (cherry-pick #19029 to version-2025.10)
fixoutpost/proxyv2: fix stale session cookie causing 400 error in createState (cherry-pick #19026 to version-2025.10)
otherinternal: rework liveness probe and proxy (cherry-pick #19312 to version-2025.10)
otherwebsite/docs: update gws provider docs (cherry-pick #18286 to version-2025.10)
featurewebsite/docs: add import to discord policy (cherry-pick #19397 to version-2025.10)
otherwebsite/docs: mention dynamic overrides in redirect stage documentation (cherry-pick #19368 to version-2025.10)
otherwebsite/docs: limiting permissions of AD service account (cherry-pick #19483 to version-2025.10)
featureproviders/oauth2: add logout+jwt token type for oidc logout token. (cherry-pick #19554 to version-2025.10)
fixinternal: fix incorrect metric calculation (cherry-pick #19701 to version-2025.10)
othercore: return bad request when user is authenticated and not active (cherry-pick #19706 to version-2025.10)
fixweb/admin: fix impersonation form requesting data without being opened (cherry-pick #19673 to version-2025.10)
featureweb/sfe: downgrade bootstrap, add access denied test (cherry-pick #19763 to version-2025.10)
fixwebsite/docs: fix Transifex link in translation guide (cherry-pick #19735 to version-2025.10)
otherroot: update client-go generation (cherry-pick #19762 and #19906 to version-2025.10)
otherrecovery: consume token in transaction (cherry-pick #19967 to version-2025.10)
otherproviders/oauth2: use compare_digest for client_secret comparison (cherry-pick #19979 to version-2025.10)
breakingwebsite/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.10)
otherdocs: add instructions for configuring rp-initiated single logout (cherry-pick #20040 to version-2025.10)
othercore: bump django from v5.2.8 to 5.2.11 (version-2025.10)
featurewebsite/docs: add email verification scope doc (cherry-pick #20141 to version-2025.10)
fixwebsite/docs: rac: fixes the property mapping formatting (cherry-pick #20200 to version-2025.10)
securitysecurity: CVE-2026-25922 (2025.10)
securitysecurity: CVE-2026-25748 (2025.10)
securitysecurity: CVE-2026-25227 (2025.10)
+4 more items in the release notesfixwebsite/docs: fix broken link in source switching doc (cherry-pick #18317 to version-2025.10)
otherwebsite/docs: further improvments to source switch doc (cherry-pick #18320 to version-2025.10)
otherwebsite/docs: enhance blueprint docs (cherry-pick #15984 to version-2025.10)
featurewebsite/docs: added missed edits on Blueprints docs (cherry-pick #18321 to version-2025.10)
featurewebsite/docs: add high availability doc (cherry-pick #18182 to version-2025.10)
otherwebsite/docs: update info about docker socket mount (cherry-pick #18344 to version-2025.10)
otheroutposts: set container healthcheck inline (cherry-pick #18298 to version-2025.10)
featureweb/admin: add entitlement search (cherry-pick #18291 to version-2025.10)
otherlib/sync/outgoing: check if there is a provider before creating tasks (cherry-pick #18394 to version-2025.10)
fixweb/admin: fix wording in password stage (cherry-pick #18393 to version-2025.10)
fixweb: Fix stale table rows (cherry-pick #17940 to version-2025.10)
otherweb: revert Fix stale table rows (cherry-pick #17940 to version-2025.10)
otherstages/prompt: set allow_blank for _read_only fields (cherry-pick #18297 to version-2025.10)
fixpackages/django-channels-postgres: fix notify size check (cherry-pick #18347 to version-2025.10)
otherwebsite/docs: improve creds recovery docs (cherry-pick #18385 to version-2025.10)
fixweb/admin: fixes capitalization in application wizard title (cherry-pick #17959 to version-2025.10)
otherwebsite/docs: update certificate doc (cherry-pick #18295 to version-2025.10)
otherproviders/scim: compare users/groups before sending update request (cherry-pick #18456 to version-2025.10)
fixweb/admin: fix brands default switch label (cherry-pick #18518 to version-2025.10)
fixwebsite/docs: expressions: fix markdown (cherry-pick #18613 to version-2025.10)
featurewebsite/docs: adds note about ak_create_jwt function (cherry-pick #18614 to version-2025.10)
otherflows: refresh unauthenticated tabs (cherry-pick #18621 to version-2025.10)
fixroot: fix missing authentik_device cookie causing error (cherry-pick #18642 to version-2025.10)
fixenterprise/stages/mtls: fix traefik certificate parsing (cherry-pick #18607 to version-2025.10)
fixweb: Fix row expansion on modal trigger buttons. (cherry-pick #18412 to version-2025.10)
fixweb/admin: fix event volume chart not updating with query (cherry-pick #18649 to version-2025.10)
othersources/ldap: make server info optional (cherry-pick #18648 to version-2025.10)
fixwebsite/docs: install-config: fix dump_config command (cherry-pick #18659 to version-2025.10)
otherroot: skip current tab when refreshing others (cherry-pick #18674 to version-2025.10)
otherweb: Hide device picker when challenges are not present. (cherry-pick #18611 to version-2025.10)
otherweb: Improved table selection behavior (cherry-pick #18622 to version-2025.10)
featurewebsite/docs: background tasks: add more detail about "next run" (cherry-pick #18660 to version-2025.10)
otheroutpost/proxyv2: more tests, fix pg password with spaces, and existing session on restart (cherry-pick #18211 to version-2025.10)
othercore: optimize list applications (cherry-pick #18330 to version-2025.10)
othercore: list applications fix (cherry-pick #18798 to version-2025.10)
otherpackages/django-dramatiq-postgres: broker: close django connections on consumer close (cherry-pick #18833 to version-2025.10)
featurewebsite/docs: add icon info to style guide (cherry-pick #18832 to version-2025.10)
otherwebsite/docs: 2025.10.3 release notes (cherry-pick #18868 to version-2025.10)
featurebrands: add more matching tests (cherry-pick #16185 to version-2025.10)
otherbrands: sort matched brand by match length (cherry-pick #17920 to version-2025.10)
fixtasks/schedules: fix rel obj not being associated or updated (cherry-pick #17934 to version-2025.10)
featurewebsite/docs: added Note about email_verified scope mapping is set to false by default (cherry-pick #17942 to version-2025.10)
breakingwebsite/docs: remove broken info box and fix sentence (cherry-pick #17963 to version-2025.10)
othercore: bump django from 5.2.7 to 5.2.8 (cherry-pick #17967 to version-2025.10)
otherwebsite/docs: updates img-src csp (cherry-pick #18010 to version-2025.10)
otherci: fix migrate-from-stable for old versions (#18019)
fixwebsite/release notes: fix broken urls (cherry-pick #18041 to version-2025.10)
otherwebsite/docs: update discord social login script example (cherry-pick #18026 to version-2025.10)
otherci: attempt to fix integration tests using dind (cherry-pick #18066 to version-2025.10)
otherci: revert to upstream GHA for release (#18058)
fixevents: fix timezone not set for log events (cherry-pick #18067 to version-2025.10)
featureproviders/scim: allow custom schema data (cherry-pick #18073 to version-2025.10)
othercore: improve app launch URL formatting (cherry-pick #18076 to version-2025.10)
breakingcmd/server/healthcheck: remove worker HTTP healthcheck (cherry-pick #18090 to version-2025.10)
fixweb: Fix RAC modal visibility. (cherry-pick #17941 to version-2025.10)
fixweb: Fix tab activation, blank provider URLs (cherry-pick #18031 to version-2025.10)
fixwebsite/docs: fix wording in stages overview (cherry-pick #18061 to version-2025.10)
otherpackages/django-dramatiq-postgres: broker: ensure locking happens with the same connection (cherry-pick #18095 to version-2025.10)
otherweb/flows: improvements for hCaptcha (cherry-pick #16882 to version-2025.10)
otherweb/admin: link to user on invitation list page (cherry-pick #18132 to version-2025.10)
fixpackages/django-channels-postgres/layer: fix query when subscribed to multiple channels (cherry-pick #18152 to version-2025.10)
otherweb: Disable library on Firefox. (cherry-pick #18103 to version-2025.10)
otherweb/sfe: downgrade bootstrap that was accidentally upgraded (cherry-pick #18157 to version-2025.10)
featurewebsite/docs: Add instructions for installing RC versions (cherry-pick #18099 to version-2025.10)
otherwebsite/docs: update application description (cherry-pick #18125 to version-2025.10)
fixstages/prompt: fix choices with labels causing error on submit (cherry-pick #18183 to version-2025.10)
otherinternal: Automated internal backport: 1487-invitation-expiry.sec.patch to authentik-2025.10
otherinternal: Automated internal backport: 1498-oauth2-cc-user-active.sec.patch to authentik-2025.10
otherinternal: Automated internal backport: 5000-sidebar.sec.patch to authentik-2025.10
featurewebsite/docs: add 2025.8.5 and 2025.10.2 release notes (cherry-pick #18268 to version-2025.10)
fixwebsite/docs: fix placeholder leftover (cherry-pick #17737 to version-2025.10)
featureroot: Add Dockerfile label org.opencontainers.image.source (cherry-pick #17756 to version-2025.10)
fixproviders/proxy: fix missing JWT/claims header (cherry-pick #17759 to version-2025.10)
othersources/oauth: Make PKCE verifier 128 characters (cherry-pick #17763 to version-2025.10)
fixproviders/radius: fix panic when no cert is configured (cherry-pick #17762 to version-2025.10)
otherproviders/oauth2: move encryption key field (cherry-pick #17722 to version-2025.10)
otherpackages/django-postgres-cache: use upsert instead of select/update in a transaction (cherry-pick #17760 to version-2025.10)
othertasks: delay startup signals (cherry-pick #17769 to version-2025.10)
otherroot: use hashes for dockerfile FROM (cherry-pick #17795 to version-2025.10)
deprecatedinternal: fix go deprecation for +build (cherry-pick #17806 to version-2025.10)
otherci: rework internal repo (#17797)
fixinternal/web/proxy: fix return status code during startup (cherry-pick #17827 to version-2025.10)
fixweb/admin: fix scim provider form (cherry-pick #17831 to version-2025.10)
othercore: bump astral-sh/uv from 0.9.5 to 0.9.6 (cherry-pick #17820 to version-2025.10)
othertasks: sanitize log attributes (cherry-pick #17833 to version-2025.10)
otheroutposts: update permissions more eagerly (cherry-pick #17783 to version-2025.10)
breakingoutpost: revert breaking signals change (cherry-pick #17847 to version-2025.10)
otherinternal: full openssl path (cherry-pick #17856 to version-2025.10)
otherweb: Consistent Tab Panel URL Parameters (cherry-pick #17804 to version-2025.10)
fixweb/a11y: User library -- fix issues surrounding element focus, ARIA labeling. (cherry-pick #17522 to version-2025.10)
fixproviders/radius: fix inverted message authenticator validation (cherry-pick #17855 to version-2025.10)
otherproviders/radius: revert fix inverted message authenticator validation (#17855) (cherry-pick #17915 to version-2025.10)
fixproviders/oauth2: fix kid always required for federation (cherry-pick #17914 to version-2025.10)
otherwebsite/docs: 2025.10.1 release notes (cherry-pick #17918 to version-2025.10)
featureenterprise: add prometheus metrics for license usage and expiry (cherry-pick #17606 to version-2025.10)
featurewebsite/docs: rel notes 2025.10: add 3 more integration guides (cherry-pick #17641 to version-2025.10)
otherproviders/proxy: drop headers with underscores (cherry-pick #17650 to version-2025.10)
featurewebsite/docs: add note about invite link not bound (cherry-pick #17657 to version-2025.10)
featurewebsite/docs: eap add info about custom validation (cherry-pick #17642 to version-2025.10)
featurewebsite/docs: release notes: Add Zot integration (cherry-pick #17700 to version-2025.10)
featurewebsite/docs: add short-lived certificate recommendation (cherry-pick #17628 to version-2025.10)
featurewebsite/docs: blueprints: add a bit more info (cherry-pick #17704 to version-2025.10)
otherenterprise: handle cached naive timezone (cherry-pick #17695 to version-2025.10)
otherwebsite/docs: update flow context ref (cherry-pick #17723 to version-2025.10)
otherwebsite/docs: finalise 2025.10 release notes (cherry-pick #17728 to version-2025.10)
breakingwebsite/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.8)
otherroot: update client-go generation (cherry-pick #19762 and #19906 to version-2025.8)
otherwebsite/docs: generate CVE sidebar (cherry-pick #20098 to version-2025.8)
securitysecurity: CVE-2026-25922 (2025.8)
securitysecurity: CVE-2026-25748 (2025.8)
securitysecurity: CVE-2026-25227 (2025.8)
otherwebsite/docs: developer docs: adjust sentence for writing docs (cherry-pick #17137 to version-2025.8)
otherbuild(deps): bump django from 5.1.12 to 5.1.13 (cherry-pick #17198 to version-2025.8)
fixpackages/django-dramatiq-postgres: broker: fix task expiration (cherry-pick #17178 to version-2025.8)
fixpackages/django-dramatiq-postgres: fix error when updating task with no changes (cherry-pick #16728 to version-2025.8)
othertasks/middlewares/messages: make sure exceptions are always logged (cherry-pick #17237 to version-2025.8)
fixcore: fix absolute and relative path file uploads (cherry-pick #17269 to version-2025.8)
fixweb: Fix behavior for modals configured with closeAfterSuccessfulSubmit (cherry-pick #17277 to version-2025.8)
otherlib/sync/outgoing: revert reduce number of db queries made (revert #14177) (cherry-pick #17306 to version-2025.8)
otherblueprints: ensure tasks retry on database errors (cherry-pick #17333 to version-2025.8)
fixweb/admin: fix incorrect placeholder for scim provider (cherry-pick #17308 to version-2025.8)
featurewebsite/docs: add entra id scim source (cherry-pick #17357 to version-2025.8)
featurewebsite/docs: add email config section (cherry-pick #16727 to version-2025.8)
featurewebsite: add powershell syntax highlighting and bump package (cherry-pick #16683)
otherwebsite/docs: update SAML provider docs (cherry-pick #15887 to version-2025.8)
otherci: rework internal repo (#17797)
otherci: fix migrate-from-stable for old versions
othercore: bump Django from 5.1.13 to 5.1.14 for 2025.8
otherinternal: Automated internal backport: 1498-oauth2-cc-user-active.sec.patch to authentik-2025.8
otherinternal: Automated internal backport: 1487-invitation-expiry.sec.patch to authentik-2025.8
otherinternal: Automated internal backport: 5000-sidebar.sec.patch to authentik-2025.8
featurewebsite/docs: add 2025.8.5 and 2025.10.2 release notes (cherry-pick #18268 to version-2025.8)
otherwebiste/docs: improve user ref doc (cherry-pick #16779)
fixproviders/scim: fix string formatting for SCIM user filter (cherry-pick #16465)
fixwebsite/docs: 2025.8: fix worker concurrency setting rename (cherry-pick #16946)
fixwebsite/docs: fix capitalization (cherry-pick #16944)
otherwebsite/docs: random typo fixes (cherry-pick #16956)
featurewebsite/docs: add docs for source switch expression policy (cherry-pick #16878)
otherwebsite/docs: update url to docker-compose.yml (cherry-pick #16901)
otherwebsite/developer docs: What domain for what doc version (cherry-pick #16987)
featureproviders/ldap: add include_children parameter to cached search mode (cherry-pick #16918)
featurewebsite/docs: oauth provider: Add device and introspect to reserved slugs (cherry-pick #16994)
featurewebiste/docs: add missing oauth endpoints (cherry-pick #16995)
otherwebsite/docs: improve discord policies when also bound to non-oauth sources (cherry-pick #17008)
fixrbac: fix typo (cherry-pick #16476)
featurecore: add index on Group.is_superuser (cherry-pick #17011)
otherlib: match exception_to_dict locals behaviour (cherry-pick #17006)
otherwebsite/docs: Update Github expression to handle non-OAuth sources gracefully (cherry-pick #17014)
fixlib/config: fix listen settings (cherry-pick #17005)
other*/bindings: order by pk (cherry-pick #17027)
fixtasks: fix logger name (cherry-pick #17009 to version-2025.8)
fixweb/admin: fix federation sources automatically selected (cherry-pick #17069 to version-2025.8)
otherrbac: optimize rbac assigned by users query (cherry-pick #17015 to version-2025.8)
fixweb: Fix layout class for row in LibraryPage (cherry-pick #16752 to version-2025.8)
othercmd/server/healthcheck: info log success instead of debug (cherry-pick #17093 to version-2025.8)
featureoutposts/ldap: add pwdChangeTime attribute (cherry-pick #17010 to version-2025.8)
fixstages/identification: fix mismatched error messages (cherry-pick #17090 to version-2025.8)
fixproviders/oauth2: fix authentication error with identical app passwords (cherry-pick #17100 to version-2025.8)
fixpackages/django-dramatiq-postgres: broker: fix new messages not being picked up when too many messages are waiting (cherry-pick #17106 to version-2025.8)
othertasks: reduce default number of retries and max backoff (cherry-pick #17107 to version-2025.8)
otherwebsite/docs: 2025.8.4 release notes (cherry-pick #17119 to version-2025.8)
fixwebsite/docs: fix docker tabs not rendering properly (cherry-pick #16799)
fixlifecycle: fix permission error when running worker as root (cherry-pick #16735)
otherwebsite/docs: update create oauth provider page (cherry-pick #16617)
fixstages/email_authenticator: Fix email mfa loop (cherry-pick #16579)
otherwebsite/docs: 2025.8.3 release notes (cherry-pick #16809)
otherwebsite/docs: 2025.8.1 release notes (cherry-pick #16343)
otherproviders/oauth2: avoid deadlock during session migration (cherry-pick #16361)
otherwebsite: cherry-pick 2025.8/client side redirects
securityroot: update security.md with github reporting link (cherry-pick #16332)
fixlifecycle: fix PROMETHEUS_MULTIPROC_DIR missing suffix (cherry-pick #16401)
fixtasks/schedules: fix api search fields (cherry-pick #16405)
featurewebsite/docs: adds details to certificates doc (cherry-pick #16335)
securityroot: fix security.md (cherry-pick #16345)
fixproviders/rac: fix AuthenticatedSession migration (cherry-pick #16400)
otherwebsite/docs: update internal vs external user information (cherry-pick #16359)
fixlib/sync: fix missing f for string (cherry-pick #16423)
otherwebsite/docs: capitalized proper name of stages, removed old version references. (cherry-pick #16414)
othercore: bump h2 from 4.2.0 to 4.3.0 (cherry-pick #16446)
fixlib/sync/outgoing: fix single object sync timeout (cherry-pick #16447)
fixcore: fix client-side only validation allowing admin to set blank user password (cherry-pick #16467)
otherwebsite: Unify Netlify redirects with Docusaurus's client-side router. (backport of #16430)
otherwebsite: Page redirect guide, documentation (backport of #16466)
breakingpolicies: remove object pk from authentik_policies_execution_time to reduce cardinality (cherry-pick #16500)
fixwebsite/integrations: bitwarden: fix ent notice (cherry-pick #16502)
otherwebsite/docs: update how to rac and outpost landing page (cherry-pick #16442)
otherwebsite/docs: improve customize your instance page layout (cherry-pick #16367)
otherwebsite/docs: update external user information (cherry-pick #16493)
otherwebsite/docs: changes all -> arrows to > (cherry-pick #16569)
breakingwebsite/docs: remove base providers redirect. (cherry-pick #16576)
featurewebsite: Add text copy of license (cherry-pick #16559)
otherroot: clean up README (cherry-pick #16286)
fixsources/ldap: fix malformed filter error with special characters in group DN (cherry-pick #16243)
othercore: bump django from 5.1.11 to v5.1.12 (cherry-pick #16584)
otherwebsite: Update license text to use "directory" (cherry-pick #16589)
otherweb/flows: only disable login button when interactive captcha is configured and not loaded (cherry-pick #16586)
featureproviders/oauth2: add missing exp claim for logout token (cherry-pick #16593)
otherproviders/scim: improve error message when object fails to sync (cherry-pick #16625)
breakingtasks: fix status and healthcheck breaking with connection issues (cherry-pick #16504)
fixwebsite/docs: fix typo (cherry-pick #16681)
featurewebsite/docs: add rate limiting info to Email stage docs (cherry-pick #16668)
featurewebsite: Redirect Azure to Entra. Add tags for search indexing. (cherry-pick #16474)
featurewebsite/docs: add missing notification rule example doc to sidebar (cherry-pick #16478)
otherwebsite/docs: clarify docker compose install (cherry-pick #16696)
otherwebsite/docs: moves display source notes (cherry-pick #16704)
fixwebsite/docs: fix typos (cherry-pick #16716)
+7 more items in the release notesfix*: Fix dead doc link (cherry-pick #16288)
fixweb: fix "Explore integrations" link in Quick actions (cherry-pick #16274)
fixweb: Fix hidden textarea required attribute. (cherry-pick #16168)
fixproviders/oauth2: fix logout token missing sid, fix wrong sub mode used (cherry-pick #16295)
otherlifecycle: set PROMETHEUS_MULTIPROC_DIR as early as possible (cherry-pick #16298)
fixweb: Fix issue where clicking a list item scrolls container (cherry-pick #16174)
otherweb: Improvements to ReCaptcha resizing (cherry-pick #16171)
fixweb: Fix form group slots (cherry-pick #16276)
otherweb: Username truncation, field alignment. (cherry-pick #16283)
featurewebsite/docs: add link in 2025.8 rel notes to back-channel logout doc (cherry pick #16306)
othercore: use email backend for test_email management command (cherry-pick #16311)
fixpackages/django-dramatiq-postgres: middleware: fix listening on hosts where ipv6 is not supported (cherry-pick #16308)
fixoutposts: fix service connection update task arguments (cherry-pick #16312)
featureoutposts: allow ingress path type configuration (cherry-pick #16339)
otherwebsite: Hotfix version 2025.8/website versioning
fixpackages/django-dramatiq-postgres: broker: fix various timing issues (cherry-pick #16340)
featurewebsite/docs: update Advanced Queries docs and Rel Notes with new Int Guide (cherry-pick #16191)
otherwebsite/docs: sys-mgmt/s3: Clean up and improve (cherry-pick #16242)
securitysecurity: Bump supported versions (cherry-pick #16261)
otherwebsite/docs: update 2025.8 release notes (cherry-pick #16269)
featuretasks: add rel_obj to system task exception event (cherry-pick #16270)
securityFixes CVE-2025-53942: Insufficient check for account active status when authenticating with OAuth/SAML Sources
fixweb/elements: fix table search not resetting page when query changes (cherry-pick #15324)
featurewebsite/docs: re-add gtag (cherry-pick #15334)
fixcore: fix missing serializer on AuthenticatedSession (cherry-pick #15323)
otherwebsite: Mark all URLs as external. (cherry-pick #15363)
fixcore: fix set_token_key permission not declared (cherry-pick #15384)
featurewebsite/docs: add manual RAC outpost deployment information (cherry-pick #15362)
otherwebsite/docs: improve the docs about our Events and logging (cherry-pick #15270)
otherwebsite/docs: Cherry pick events docs (cherry-pick #15457)
otherwebsite/docs: postgres troubleshooting: get PGPASSWORD from POSTGRES_PASSWORD_FILE (cherry-pick #15039)
fixwebsite/docs: troubleshooting: Fix variable for postgres database in k8s (cherry-pick #15503)
fixproviders/proxy: fix ingress-nginx proxy buffer size annotations (cherry-pick #15506)
featurewebsite/docs: add noun for SSO (cherry-pick #15509)
featurewebsite/docs: Add FIDO2 references to the documentation (cherry-pick #14826)
featurewebsite/docs: add use case, move diagram, link to ABM (cherry-pick #15491)
fixwebsite/docs: fix a typo in SSF docs (cherry-pick #15554)
featurewebsite/docs: added enterprise label to new Logging docs (cherry-pick #15556)
fixwebsite/docs: fix user ref typos (cherry-pick #15653)
otherproviders/radius: set message authenticator (cherry-pick #15635)
featurewebsite/docs: add more to style guide (cherry-pick #14797)
otherci: fix post-release e2e builds failing (cherry-pick #15082)
featureweb/elements: Add light mode custom css handling (cherry-pick #14944)
othercore: bump tornado from 6.4.2 to v6.5.1 (cherry-pick #15100)
othercore: bump requests from 2.32.3 to v2.32.4 (cherry-pick #15129)
fixsources/ldap: fix sync on empty groups (cherry-pick #15158)
othercore: bump urllib3 from 2.4.0 to v2.5.0 (cherry-pick #15131)
othercore: bump protobuf from 6.30.2 to v6.31.1 (cherry-pick #14894)
fixwebsite/docs: fixes misplaced sentence (cherry-pick #14998)
fixwebsite/docs: fix egregious maintenance fail (cherry-pick #15176)
fixweb/user: fix infinite loop when no user settings flow is set (cherry-pick #15188)
otherci: fix CodeQL failing on cherry-pick PRs (cherry-pick #15205)
featurewebsite/docs: add credentials prompt for rac doc (cherry-pick #14840)
fixwebsite/docs: fix note at end of rac credentials prompt (cherry-pick #14909)
featurewebsite/docs: Add steps to troubleshoot /initial-setup/ (cherry-pick #15011)
otherweb/elements: typing error when variables are not converted to string (cherry-pick #15169)
othercore: bump goauthentik/fips-python from 3.13.3-slim-bookworm-fips to 3.13.5-slim-bookworm-fips in 2025.6
securitysecurity: fix CVE-2025-52553 (cherry-pick #15289)
featurewebsite/docs: add 2025.6.1 release notes (cherry-pick #14948)
otherstages/email: Only attach logo to email if used (cherry-pick #14835)
fixweb/elements: fix dual select without sortBy (cherry-pick #14977)
fixinternal/outpost: fix incorrect usage of golang SHA API (cherry-pick #14981)
fixbrands: fix custom_css being escaped (cherry-pick #14994)
othercore: bump django from 5.1.9 to 5.1.10 (cherry-pick #14951)
othercore: bump django from 5.1.10 to 5.1.11 (cherry-pick #14997)
otherwebsite/docs: also hide the postgres pool_options setting (cherry-pick #15023)
fixproviders/rac: fixes prompt data not being merged with connection_settings (cherry-pick #15037)
fixweb/elements: fix typo in localeComparator (cherry-pick #15054)
otherwebsite/docs: correct minor version in release notes (cherry-pick #15012)
breakingwebsite/docs: remove commented out config options (cherry-pick #15064)
fixcore: fix transaction test case (cherry-pick #15021)
otherwebsite/docs: release notes for 2025.6.2 (cherry-pick #15065)
featurewebsite/releases: order new integrations alphabetically (cherry-pick #14850)
featurewebsite/release notes: add tailscale to new integrations (cherry-pick #14859)
otherwebsite/integrations: tailscale (cherry-pick #14499)
otherwebsite/docs: rotate supported versions: 2025.6 (cherry-pick #14856)
fixweb/user: fix user settings flow not loading (cherry-pick #14911)
featureproviders/proxy: add option to override host header with property mappings (cherry-pick #14927)
fixlifecycle: fix test-all in docker
featurewebsite/integrations: adds missing trailing slash in homarr doc
fixweb: fix bug that was causing charts to be too tall
featurewebsite/docs: add device code flow instructions
featurerbac: add name to Permissions search
featurewebsite/docs: add postgres pool configuration
featurewebsite/docs: add LDAP 'Lookup using user attribute' docs
featurewebsite/docs: add gateway API to release notes and documentation
fixwebsite/docs: initial permissions: fix usage of term admin
breakingwebsite/docs: clarify 2025.4 breaking Reputation changes
fixbrands: fix CSS Migration not updating brands
featurewebsite/docs: adds webfinger doc under oauth provider
fixrbac: fix RoleObjectPermissionTable not showing add_user_to_group
fixwebsite/docs: fix dry-run release highlight
breakingwebsite/docs: remove support badge
fixweb: Clean up browser-only module imports that crash WebDriverIO.
featurewebsite/integrations: add atlassian
featurewebsite/docs: Add pkg-config to the brew dependencies
featurewebsite/docs: add one more reference and link about can view Admin interface
featuretests/e2e: Add E2E tests for Flow SFE
breakingcore: remove OldAuthenticatedSession content type
featuretests/e2e: add test for authentication flow in compatibility mode
featureenterprise/stages: Add MTLS stage
securitywebsite/integrations: add push security
deprecatedwebsite/integrations: minio: notice about sso deprecation on CE
featurewebsite/docs: add login page source note to all source docs
featureweb: Add specific Storybook dependency.
featuresources/ldap: add forward deletion option
featurewebsite/integrations: add stripe
featurewebsite/integrations: add filerise
featurewebsite/integrations: add pangolin
featurewebsite/docs: add docs for MTLS Stage
featuresources/ldap: add user_membership_attribute
breakingstages/user_login: remove success message
breakingwebsite/docs: configuration: remove deprecated key for session storage location
featurewebsite/integrations: add komodo
featureproviders/scim: allow for specifying custom SCIM schemas for users and groups
breakingwebsite/docs: remove fluff from release notes 2025.6 (cherry-pick #14819)
breakingwebsite/integrations: remove trailing slash from budibase redirect (cherry-pick #14823)
featurewebsite/docs: add LDAP docs for forward deletion and memberUid (cherry-pick #14814)
+281 more items in the release notessecurityFixes CVE-2025-53942: Insufficient check for account active status when authenticating with OAuth/SAML Sources
featurewebsite/docs: add manual RAC outpost deployment information (cherry-pick #15362)
securityFixes CVE-2025-52553: Insufficient Session verification for Remote Access Control endpoint access
otherwebsite/docs: also hide the postgres pool_options setting (cherry-pick #15023)
breakingwebsite/docs: remove commented out config options (cherry-pick #15064)
fixwebsite/docs: fix egregious maintenance fail (cherry-pick #15176)
fixwebsite/docs: fixes misplaced sentence (cherry-pick #14998)
fixlifecycle: fix arguments not being passed to worker command (cherry-pick #14574)
fixsources/scim: fix all users being added to group when no members are given (cherry-pick #14645)
otherci: fix broken cache (cherry-pick #14725)
othercore: Migrate permissions before deleteing OldAuthenticatedSession (cherry-pick #14788)
breakingwebsite/docs: clarify 2025.4 breaking Reputation changes (cherry-pick #14284)
fixwebsite/docs: fix dry-run release highlight (cherry-pick #14337)
fixwebsite/docs: fix leftover placeholder in release notes (cherry-pick #14377)
otherwebsite/docs: release notes for 2025.4.1 (cherry-pick #14526)
otherwebsite/docs: release notes for 2025.4.2 (cherry-pick #14868)
featurewebsite/docs: add gateway API to release notes and documentation (cherry-pick #14278)
otherci: cleanup post uv migration (cherry-pick #13538)
fixwebsite/docs: initial permissions: fix usage of term admin (cherry-pick #14300)
fixbrands: fix CSS Migration not updating brands (cherry-pick #14306)
otherwebsite/docs: docs about initial perms (cherry-pick #14263)
fixrbac: fix RoleObjectPermissionTable not showing add_user_to_group (cherry-pick #14312)
fixoutposts: fix tmpdir in containers not being set (cherry-pick #14444)
fixlifecycle: fix ak dump_config (cherry-pick #14445)
fixweb/flows/sfe: fix global background image not being loaded (cherry-pick #14442)
othercore: bump h11 from 0.14.0 to v0.16.0 (cherry-pick #14352)
fixcore: fix session migration when old session can't be loaded (cherry-pick #14466)
otherroot: temporarily deactivate database pool option (cherry-pick #14443)
otherroot: backport SFE Build fix
fixenterprise: fix expired license's users being counted (cherry-pick #14451)
breakingcore: remove OldAuthenticatedSession content type (cherry-pick #14507)
fixcore: fix unable to create group if no enable_group_superuser permission is given (cherry-pick #14510)
featurewebsite/docs: add 2025.2 release notes
featuresources/oauth: add group sync for azure_ad
featureroot: allow configuring session cookie age
featurecore: add darkreader-lock
featurewebsite/docs: add new SSF provider docs
featurewebsite/docs: add info about new perms for super-user in groups
breakingwebsite/docs: remove mention of wizard
breakingwebsite/docs: remove Enterprise badge from RAC docs
featurewebsite/docs: add paragraph about impossible travel
breakingwebsite/docs: fix missing breaking entry for 2025.2 release notes
featurewebsite/docs: Add Passkeys reference where WebAuthn is mentioned
breakingwebsite: remove images from integrations index page
featurelifecycle: add warning regarding supported installation methods
featurecore: add pre-hydrated relative URL
featurewebsite/integrations: add plesk
featurewebsite/docs: add enterprise label to SSF docs
breakingwebsite/docs: remove Enterprise badge from RAC docs -- again
featurewebsite/integrations: Add documentation for Drupal
featurewebsite/docs: enterprise: add instructions to cancel license renewal
featurelib/sync/outgoing: add dry run
breakingstages/authenticator_email: remove flaky assertions
featurewebsite/integrations: gravity: add
featureweb/admin: add button to clear application cache
featureweb/admin: allow user lists to show active only
featurewebsite: add a better edit this page element
featurewebsite/integrations: zipline: add
breakingwebsite/docs: backup and restore: remove extra period
deprecatedwebsite/docs: in developer docs replace deprecated poetry shell command
featurewebsite/integrations: add Mautic
featurewebsite/docs: ops/backup-restore: add "pending emails" to lost redis data
featurewebsite: edit the new footer with links
featureproviders/scim: add compatibility mode for AWS & Slack
breakingwebsite: remove the last updated option from footer
breakingwebsite/docs: dev docs: full: remove note on installing shell plugin
securitysecurity: fix CVE-2025-29928
deprecatedcore: bump deprecated from 1.2.14 to v1.2.18
breakingwebsite/docs: Remove enterprise badge from Fleet integration
breakingwebsite integrations: actual budget: remove old header and support_level
deprecatedwebsite: integrations: apache guacamole: Fix deprecated start-of-doc …
breakingwebsite: integrations: apache guacamole: remove redirect URI comments
+538 more items in the release notesfixstages/email: fix for newlines in emails
fixproviders/scim: fix group membership check failing (cherry-pick #13644)
fixRevert "core: fix non-exploitable open redirect (#13696)" (cherry-pick #13824)
fixadmin: fix system API when using bearer token (cherry-pick #13651)
otherstages/email: Clean newline characters in TemplateEmailMessage (cherry-pick #13666)
fixoutposts/ldap: fix paginator going into infinite loop (cherry-pick #13677)
otherweb/admin: reworked sync status card (cherry-pick #13625)
fixcore: fix core/user is_superuser filter (cherry-pick #13693)
fixcore: fix non-exploitable open redirect (cherry-pick #13696)
otherstages/identification: refresh captcha on failure (cherry-pick #13697)
securitysecurity: fix CVE-2025-29928 (cherry-pick #13695)
otherwebsite/docs: prepare for 2025.2.1 (cherry-pick #13277)
fixenterprise/stages/source: fix dispatch method signature (cherry-pick #13321)
fix*: fix stage incorrectly being inserted instead of appended (cherry-pick #13304)
otherwebsite/docs: update the 2025.2 rel notes (cherry-pick #13213)
fixproviders/proxy: kubernetes outpost: fix reconcile when only annotations changed (cherry-pick #13372)
fixwebsite/docs: fix build
otherweb/user: ensure modal container on user-settings page is min-height: 100% (cherry-pick #13402)
fixstages/authenticator_email: Fix Enroll dropdown in the MFA Devices page (cherry-pick #13404)
fixlib/config: fix conn_max_age parsing (cherry-pick #13370)
fixweb/admin: fix display bug for assigned users in application bindings in the wizard (cherry-pick #13435)
othersources/oauth: ignore missing well-known keys (cherry-pick #13468)
fixweb/flows: fix missing padding on authenticator_validate card (cherry-pick #13420)
otherweb/user: show admin interface button on mobile (cherry-pick #13421)
fixproviders/rac: fix signals and Endpoint caching (cherry-pick #13529)
fixsources/oauth: fix duplicate authentication (cherry-pick #13322)
otherstages/identification: check captcha after checking authentication (cherry-pick #13533)
otherwebsite/docs: prepare for 2025.2.2 (cherry-pick #13552)
breakingwebsite/docs: remove Enterprise badge from RAC docs (cherry-pick #13069)
featurewebsite/docs: add new SSF provider docs (cherry-pick #13102)
featurewebsite/docs: add info about new perms for super-user in groups (cherry-pick #13188)
breakingwebsite/docs: remove mention of wizard (cherry-pick #13126)
featurewebsite/docs: add paragraph about impossible travel (cherry-pick #13125)
otherstages/authenticator_email: Email Authenticator Stage Documentation (cherry-pick #12853)
breakingwebsite/docs: fix missing breaking entry for 2025.2 release notes (cherry-pick #13223)
featurecore: add pre-hydrated relative URL (cherry-pick #13243)
fixstages/email: Fix email stage serialization (cherry-pick #13256)
fixstages/authenticator_email: fix session cleanup test b (cherry-pick #13264)
fixweb/flow: fix translate extract (cherry-pick #13208)
fixweb/user: fix display for RAC tile (cherry-pick #13211)
fixRevert "core: fix non-exploitable open redirect (#13696)"
fixcore: fix generic sources not being fetchable by pk
fixflows: fix inspector permission check
securitysecurity: fix CVE-2025-29928 (cherry-pick #13695)
otherenterprise/rac: Improve client connection status & bugfixes (cherry-pick #12684)
otherci: release: fix AWS cfn template permissions (cherry-pick #12576)
fixstages/redirect: fix query parameter when redirecting to flow (cherry-pick #12750)
fixlifecycle: fix cryptography's OpenSSL path (cherry-pick #12753)
otherci: fix missing build args for dev and release (cherry-pick #12760)
featuresources: allow uuid or slug to be used for retrieving a source (2024.12 fix)
fixcore: fix application entitlements not createable with blueprints (cherry-pick #12673)
otherlifecycle: update python to 3.12.8 (cherry-pick #12783)
fixcore: fix permissions for admin device listing (cherry-pick #12787)
otherflows: clear flow state before redirecting to final URL (cherry-pick #12788)
otherrbac: exclude permissions for internal models (cherry-pick #12803)
otherlifecycle: better pre release test (cherry-pick #12806)
otherci: fix test_docker.sh failing due to missing .env (cherry-pick #12873)
otherci: fix test_docker.sh failing due to empty .env (cherry-pick #12876)
otherci: fix test_docker.sh (cherry-pick #12878)
otherci: fix test_docker.sh (cherry-pick #12880)
fixinternal: fix missing trailing slash in outpost websocket (cherry-pick #12470)
othersources/kerberos: authenticate with the user's username instead of the first username in authentik (cherry-pick #12497)
featurerbac: permissions endpoint: allow authenticated users (cherry-pick #12608)
fixcore: fix error when creating new user with default path (cherry-pick #12609)
fixproviders/saml: fix invalid SAML Response when assertion and response are signed (cherry-pick #12611)
featurewebsite/docs: add new section about impersonation (cherry-pick #12328)
featurewebsite/docs: add content about bindings (cherry-pick #11787)
fixinternal: fix URL generation for websocket connection (cherry-pick #12439)
othertranslate: Updates for file web/xliff/en.xlf in zh-Hans (cherry-pick #12401)
othertranslate: Updates for file locale/en/LC_MESSAGES/django.po in zh-Hans (cherry-pick #12400)
othertranslate: Updates for file locale/en/LC_MESSAGES/django.po in zh_CN (cherry-pick #12399)
othertranslate: Updates for file web/xliff/en.xlf in zh_CN (cherry-pick #12402)
otherevents: notification_cleanup: avoid unnecessary loop (cherry-pick #12417)
otherroot: expose CONN_MAX_AGE, CONN_HEALTH_CHECKS and DISABLE_SERVER_SIDE_CURSORS for PostgreSQL config (cherry-pick #10159)
otherwebsite/docs: prepare for 2024.12.0 (cherry-pick #12420)
fixroot: fix database ssl options not set correctly (cherry-pick #12180)
otherweb: backport fix impersonate api
otherweb/flows: resize captcha iframes (cherry-pick #12260)
fixstages/identification: fix invalid challenge warning when no captcha stage is set (cherry-pick #12312)
otherenterprise/stages/authenticator_endpoint_gdtc: don't set frame options globally (cherry-pick #12311)
otherflows: better test stage's challenge responses (cherry-pick #12316)
fixproviders/proxy: fix redirect_uri (cherry-pick #12121)
fixproviders/oauth2: fix redirect uri input (cherry-pick #12122)
otherweb: bump API Client version (cherry-pick #12129)
fixproviders/oauth2: fix migration dependencies (cherry-pick #12123)
fixproviders/oauth2: fix migration (cherry-pick #12138)
securityFixes CVE-2024-52287: Insufficient validation of OAuth scopes for client_credentials and device_code grants
securityFixes CVE-2024-52307: Timing attack due to a lack of constant time comparison for metrics view
securityNote that this security release includes backwards incompatible database changes; see https://docs.goauthentik.io/docs/security/cves/CVE-2024-52289#patches
fixproviders/ldap: fix global search_full_directory permission not being sufficient (cherry-pick #12028)
fixrbac: fix incorrect object_description for object-level permissions (cherry-pick #12029)
fixweb/flows: fix invisible captcha call (cherry-pick #12048)
fixcore: fix source_flow_manager throwing error when authenticated user attempts to re-authenticate with existing link (cherry-pick #12080)
otherproviders/scim: accept string and int for SCIM IDs (cherry-pick #12093)
fixroot: fix activation of locale not being scoped (cherry-pick #12091)
otherroot: check remote IP for proxy protocol same as HTTP/etc (cherry-pick #12094)
otherwebsite/docs: group CVEs by year (cherry-pick #12099)
featureinternal: add CSP header to files in /media (cherry-pick #12092)
featurewebsite/docs: add CSP to hardening (cherry-pick #11970)
securitysecurity: fix CVE 2024 52287 (cherry-pick #12114)
fixwebsite/docs: fix slug matching redirect URI causing broken refresh (cherry-pick #11950)
otherstages/password: use recovery flow from brand (cherry-pick #11953)
otherstages/captcha: Run interactive captcha in Frame (cherry-pick #11857)
featureblueprints: add default Password policy (cherry-pick #11793)
fixproviders/proxy: fix Issuer when AUTHENTIK_HOST_BROWSER is set (cherry-pick #11968)
othercrypto: validate that generated certificate's name is unique (cherry-pick #12015)
fixproviders/oauth2: fix manual device code entry (cherry-pick #12017)
othercore: use versioned_script for path only (cherry-pick #12003)
otherwebsite/docs: 2024.10.2 release notes (cherry-pick #12025)
otherwebsite: update supported versions (cherry-pick #11841)
fixproviders/oauth2: fix size limited index for tokens (cherry-pick #11879)
featurecore: add None check to a device's extra_description (cherry-pick #11904)
fixenterprise/rac: fix API Schema for invalidation_flow (cherry-pick #11907)
fixwebsite/docs: fix release notes to say Federation (cherry-pick #11889)
fixwebsite: fix docs redirect (cherry-pick #11873)
featurewebsite/docs: add info about invalidation flow, default flows in general (cherry-pick #11800)
breakingwebsite: remove RC disclaimer for version 2024.10 (cherry-pick #11871)
otherwebsite/docs: 2024.10.1 Release Notes (cherry-pick #11926)
otherwebsite/docs: Update social-logins github (cherry-pick #11822)
breakingwebsite/docs: remove � (cherry-pick #11823)
otherwebsite: 2024.10 Release Notes (cherry-pick #11839)
featuresources/kerberos: add kiprop to ignored system principals (cherry-pick #11852)
fixweb/admin: fix code-based MFA toggle not working in wizard (cherry-pick #11854)
otherroot: bumpversion 2024.10
fixproviders/proxy: fix redirect_uri (cherry-pick #12121)
fixproviders/oauth2: fix redirect uri input (cherry-pick #12122)
otherweb: bump API Client version (cherry-pick #12129)
fixproviders/oauth2: fix migration (cherry-pick #12138)
securityFixes CVE-2024-52287: Insufficient validation of OAuth scopes for client_credentials and device_code grants
securityFixes CVE-2024-52307: Timing attack due to a lack of constant time comparison for metrics view
securityNote that this security release includes backwards incompatible database changes; see https://docs.goauthentik.io/docs/security/cves/CVE-2024-52289#patches
otherinternal: restore /ping behaviour for embedded outpost (cherry-pick #11568)
fixcore: fix permission check for scoped impersonation (cherry-pick #11603)
fixblueprints: fix validation error when using internal storage (cherry-pick #11654)
fixproviders/saml: fix incorrect ds:Reference URI (cherry-pick #11699)
otherproviders/oauth2: don't overwrite attributes when updating service acccount (cherry-pick #11709)
fixweb/admin: fix invalid create date shown for MFA registered before date was saved (cherry-pick #11728)
fixpolicies/event_matcher: fix inconsistent behaviour (cherry-pick #11724)
fixweb/admin: fix sync single button throwing error (cherry-pick #11727)
featureproviders/scim: add comparison with existing group on update and delta update users (cherry-pick #11414)
otherproviders/scim: clamp batch size for patch requests (cherry-pick #11797)
otherproviders/scim: handle no members in group in consistency check (cherry-pick #11801)
otherevents: always use expiry from current tenant for events, not only when creating from HTTP request (cherry-pick #11415)
fixproviders/proxy: fix traefik label generation (cherry-pick #11460)
fixweb/admin: fix Authentication flow being required (cherry-pick #11496)
fixsources/ldap: fix mapping check, fix debug endpoint (cherry-pick #11442)
fixsources/ldap: fix ms_ad userAccountControl not checking for lockout (cherry-pick #11532)
securitysecurity: fix CVE-2024-47077 (cherry-pick #11535)
securitysecurity: fix CVE-2024-47070 (cherry-pick #11536)
othercore: ensure proxy provider is correctly looked up (cherry-pick #11267)
fixroot: fix ensure outpost_connection_discovery runs on worker startup (cherry-pick #11260)
othercore: ensure all providers have correct priority (cherry-pick #11280)
otherevents: optimise marking events as seen (cherry-pick #11297)
fixweb/admin: fix notification property mapping forms (cherry-pick #11298)
fixcore: fix permission check for scoped impersonation (cherry-pick #11315)
otherenterprise: show specific error if Install ID is invalid in license (cherry-pick #11317)
fixsources/ldap: fix missing search attribute (cherry-pick #11125)
fixenterprise: fix API mixin license validity check (cherry-pick #11331)
fixproviders/proxy: fix URL path getting lost when partial URL is given to rd= (cherry-pick #11354)
fixproviders/ldap: fix migration assuming search group is set (cherry-pick #11170)
fixweb/admin: fix error in Outpost creation form (cherry-pick #11173)
fixcore: fix change_user_type always requiring usernames (cherry-pick #11177)
otherroot: backport s3 storage changes (cherry-pick #11181)
othercore: bump cryptography from 43.0.0 to 43.0.1 (cherry-pick #11185)
featurewebsite/docs: add note about terraform provider (cherry-pick #11206)
fixweb/admin: fix missing Sync object button SCIM Provider (cherry-pick #11211)
fixproviders/ldap: fix incorrect permission check for search access (cherry-pick #11217)
otherweb/admin: improve error handling (cherry-pick #11212)
otherproviders/ldap: rework search_group migration to work with read replicas (cherry-pick #11228)
fixcore: fix missing argument name escaping for property mapping (cherry-pick #11231)
fixinternal: fix go paginator not setting page correctly (cherry-pick #11253)
otherweb/users: show - if device was registered before we started saving the time (cherry-pick #11256)
otherwebsite/docs: 2024.8 release notes: reword group sync disable and fix typo (cherry-pick #11103)
fixenterprise: fix incorrect comparison for latest validity date (cherry-pick #11109)
otherci: fix failing release attestation (cherry-pick #11107)
fixweb: fix dual-select with dynamic selection (cherry-pick #11133)
securitysecurity: fix CVE-2024-47077 (cherry-pick #11535)
securitysecurity: fix CVE-2024-47070 (cherry-pick #11536)
fixweb/admin: fix selectable card colour in dark theme (cherry-pick #10794)
featuresources/ldap: Add enabled filter for ldap_password_validate signal (cherry-pick #10823)
securitysecurity: fix CVE-2024-42490 (cherry-pick #11022)
fixweb: fix theme not applying to document correctly (cherry-pick #10721)
fixsources/scim: fix duplicate service account users and changing token (cherry-pick #10735)
otherweb: replace all occurences of the theme placeholder (cherry-pick #10749)
fixenterprise/rac: fix error when listing connection tokens as non-superuser (cherry-pick #10771)
othercore: improve error handling on ASGI level (cherry-pick #10547)
otherlib/sync: handle SkipObject in direct triggered tasks (cherry-pick #10590)
fixstages/prompt: fix prompt not editable with invalid expression (cherry-pick #10603)
fixevents: fix race condition (cherry-pick #10602)
breakingcore: remove html language tag for pages that are translated (cherry-pick #10611)
fixweb/admin: fix missing SAML Provider ECDSA options (cherry-pick #10612)
otherlifecycle: only create tenant media root if needed (cherry-pick #10616)
breakingweb/flows: remove continue button from AutoSubmit stage (cherry-pick #10253)
otherevents: associate login_failed events to a user if possible (cherry-pick #10270)
otherweb/admin: show matching user reputation scores in user details (cherry-pick #10276)
otheroutposts: make refresh interval configurable (cherry-pick #10138)
otheroutposts: ensure minimum refresh interval (cherry-pick #10701)
fixtests/e2e: fix ldap tests following #10270 (cherry-pick #10288)
otherwebsite/docs: update 2024.6 release notes with latest changes (cherry-pick #10228)
breakingwebsite/docs: remove RC disclaimer from 2024.6 release notes (cherry-pick #10245)
securitysecurity: update supported versions (cherry-pick #10247)
otherwebsite/docs: update geoip and asn example to use the proper syntax (cherry-pick #10249)
otherwebsite/docs: update geoip and asn documentation following field changes (cherry-pick #10265)
fixstages/user_login: fix ?next parameter not carried through broken session binding (cherry-pick #10301)
breakingweb/flows: remove background image link (cherry-pick #10318)
breakingcore: remove transitionary old JS urls (cherry-pick #10317)
fixprovider/scim: Fix exception handling for missing ServiceProviderConfig (cherry-pick #10322)
fixproviders/saml: fix metadata import error handling (cherry-pick #10349)
fixsources/saml: fix pickle error, add saml auth tests (cherry-pick #10348)
fixsources/oauth: fix link not being saved (cherry-pick #10374)
fixstages/authenticator_validate: fix friendly_name being required (cherry-pick #10382)
fixcore: fix migrations missing using db_alias (cherry-pick #10409)
fixweb/admin: fix access token list calling wrong API (cherry-pick #10434)
fixcore: fix source flow_manager not resuming flow when linking (cherry-pick #10436)
othercore: revert backchannel only filtering (cherry-pick #10455)
featurewebsite/docs: add 2024.6.1 release notes (cherry-pick #10456)
breakingwebsite/docs: Remove hyphen in read replica in Release Notes (cherry-pick #10178)
othercore: rework base for SkipObject exception to better support control flow exceptions (cherry-pick #10186)
otherweb/flows: update flow background (cherry-pick #10206)
securitysecurity: fix CVE-2024-38371 (cherry-pick #10229)
securitysecurity: fix CVE-2024-37905 (cherry-pick #10230)
otherwebsite/docs: update 2024.4 release notes with latest changes (cherry-pick #10231)
securitysecurity: fix CVE-2024-42490 (cherry-pick #11022)
fixcore: fix source flow_manager not always appending save stage (cherry-pick #9659)
fixweb: fix value handling inside controlled components (cherry-pick #9648)
fixsources/saml: fix FlowPlanner error due to pickle (cherry-pick #9708)
securitysecurity: fix CVE-2024-38371 (cherry-pick #10229)
securitysecurity: fix CVE-2024-37905 (cherry-pick #10230)
securityFixes CVE-2024-37905: Improper Authorization for Token modification
fixsources/oauth: fix OAuth Client sending token request incorrectly (cherry-pick #9474)
fixflows: fix execute API endpoint (cherry-pick #9478)
otherevents: ensure all models' str can be called without any further lookups (cherry-pick #9480)
fixweb/flows: fix missing fallback for flow logo (cherry-pick #9487)
othercore: only prefetch related objects when required (cherry-pick #9476)
featureweb: Add missing integrity hashes to package-lock.json
otherlifecycle: close database connection after migrating (cherry-pick #9516)
fixproviders/saml: fix ecdsa support (cherry-pick #9537)
fixweb/flows: fix error when enrolling multiple WebAuthn devices consecutively (cherry-pick #9545)
fixproviders/scim: fix time_limit not set correctly (cherry-pick #9546)
fixenterprise/audit: fix audit logging with m2m relations (cherry-pick #9571)
fixcore: fix source_flow_manager saving user-source connection too early (cherry-pick #9559)
fixproviders/scim: fix SCIM ID incorrectly used as primary key (cherry-pick #9557)
fixtenants: fix scheduled tasks not running on default tenant (cherry-pick #9583)
fixcore: fix task clean_expiring_models removing valid sessions with using database storage (cherry-pick #9598)
fixcore: fix condition in task clean_expiring_models (cherry-pick #9603)
fixsources/scim: fix duplicate groups and invalid schema (cherry-pick #9466)
otherwebsite/docs: prepare 2024.4.2 release notes (cherry-pick #9555)
otherweb: markdown: display markdown even when frontmatter is missing (cherry-pick #9404)
othersources/oauth: ensure all UI sources return a valid source (cherry-pick #9401)
otherstages/identification: don't check source component (cherry-pick #9410)
featureweb: Add resolved and integrity fields back to package-lock.json (cherry-pick #9419)
fixcore: fix logic for token expiration (cherry-pick #9426)
otherci: fix ci pipeline (cherry-pick #9427)
fixweb/common: fix locale detection for user-set locale (cherry-pick #9436)
otherlifecycle: always try custom redis URL (cherry-pick #9441)
otherwebsite/docs: prepare 2024.4.1 (cherry-pick #9459)
otherweb/admin: show user internal service account as disabled (cherry-pick #9464)
fixweb/admin: fix disabled button color with dark theme (cherry-pick #9465)
fixsources/scim: fix service account user path (cherry-pick #9463)
otherwebsite/docs: update release notes for 2024.4.1 again (cherry-pick #9471)
breakingwebsite/docs: remove outdated info
breakingwebsite/docs: remove tenants docs from sidebar for now
featurewebsite/docs: added a new template for "combo" topics
featurewebsite/blog: add draft for blog about fletcher joining
breakingwebsite/docs: 2024.2: update comment about upgrading to mention breaking changes
featurewebsite: add solve gitea group does not take effect
featurewebsite/docs: Add documentation for Glitchtip
featureAdd missing commas, correction of spelling errors
featurewebsite/integrations: add documentation for OIDC setup with Paperless-ngx
featuresources/oauth: add gitlab type [AUTH-323]
featurewebsite/integrations: Add description for custom enrollment to azure ad
featurewebsite/docs: new landing page for Providers
featurewebsite/docs: add link to CRUD docs
featurewebsite/docs: add new name "Microsft Entra ID" for Azure AD
breakingwebsite/docs: config: remove options moved to tenants
breakingweb/admin: remove enterprise preview banner
featurewebsite/docs: add example policy to enforce unique email address
featurewebsite/deverlop-docs website/integrations: add links to integrations template
featuresources/ldap: add ability to disable password write on login
featurewebsite/docs: maintenance, re-add system settings
featurewebsite/integrations: add documentation for OIDC setup with Xen Orchestra
featureweb/admin: allow custom sorting for bound* tables
featurewebsite/integrations: add outline knowledge base
featurewebsite/docs: add procedural docs for RAC
featurestages/authenticator_webauthn: add MDS support
featureevents: add context manager to ignore/modify audit events being written
featurewebsite/docs: add note for flow compatibility mode
featurecore: add user settable token durations
featurestages/authenticator_validate: add ability to limit webauthn device types
featurewebsite/docs: add more info and links about enforciing unique email addresses
featurewebsite/integrations: nextcloud: add tip to solve hashed groups configuring OAuth2
featureinternal: add tests to go flow executor
featurewebsite/docs: add websocket support to nginx snippets
featurewebsite/integrations: add pfSense search scope
featureproviders/scim: allow custom user and group schemas
featuresources: add SCIM source
featureevents: add indexes
featurewebsite/docs: system settings: add default token duration and length
featureroot: make redis settings more consistent and allow TLS CA
featurebrands: add indexes to brand domain and default
+403 more items in the release notessecuritysecurity: fix CVE-2024-38371 (cherry-pick #10229)
securitysecurity: fix CVE-2024-37905 (cherry-pick #10230)
otherenterprise: only check for valid license existing for creating Enterprise objects (cherry-pick #8813)
otherstages/email: Disable autoescape for text templates (cherry-pick #8812)
fixstages/email: fix issue when sending emails to users with same display as email (cherry-pick #8850)
othertenants: really ensure default tenant cannot be deleted (cherry-pick #8875)
otherapi: capabilities: properly set can_save_media when s3 is enabled (cherry-pick #8896)
fixenterprise/rac: fix connection token management (cherry-pick #8909)
otherstages/user_write: ensure user data is json-serializable (cherry-pick #8926)
otherevents: discard notification if user has empty email (cherry-pick #8938)
breakingwebsite/docs: config: remove options moved to tenants (cherry-pick #8976)
otherlifecycle: migrate: ensure template schema exists before migrating (cherry-pick #8952)
fixproviders/oauth2: fix inconsistent sub value when setting via mapping (cherry-pick #8677)
fixcore: fix blueprint export (cherry-pick #8695)
fixenterprise: fix read_only activating when no license is installed (cherry-pick #8697)
fixwebsite/docs: s3: fix environment variables (cherry-pick #8722)
otherenterprise: force license usage update after change to license (cherry-pick #8723)
fixroot: fix container build (cherry-pick #8727)
otherci: fix missing DOCKER_USERNAME secret (cherry-pick #8730)
fixproviders/oauth2: fix offline_access requests when prompt doesn't include consent (cherry-pick #8731)
fixwebsite/docs: s3: fix migration docs (cherry-pick #8735)
fixstages/authenticator_webauthn: fix error when enrolling new device (cherry-pick #8738)
otherci: fix missing output on composite action (cherry-pick #8741)
otherweb/admin: don't mark property mappings as required anywhere (cherry-pick #8752)
otherweb/admin: don't mark remaining property mappings as required (cherry-pick #8772)
otherroot: ensure consistent install_id (cherry-pick #8775)
fixwebsite/docs: installation: kubernetes: fix values (cherry-pick #8783)
fixproviders/oauth2: fix validation ordering (cherry-pick #8793)
fixflows: fix mismatched redirect behaviour for invalid and valid flows (cherry-pick #8794)
fixstages/authenticator_validate: fix error with get_webauthn_challenge_without_user (cherry-pick #8625)
otherci: fix missing tags from release (cherry-pick #8645)
otherevents: sanitize args and kwargs saved in system tasks (cherry-pick #8644)
fixbrands: fix context processor when request doesn't have a tenant (cherry-pick #8643)
otherwebsite/docs: kubernetes installation: update values (cherry-pick #8575)
fixrbac: fix permission decorator for global permissions (cherry-pick #8591)
otherweb: spell customization with a Z (cherry-pick #8596)
fixweb/flows: fix webauthn retry (cherry-pick #8599)
othersources/oauth: revert azure_ad profile URL change (cherry-pick #8139)
fixweb/flows: fix icon for generic oauth source with dark theme (cherry-pick #8148)
fixsources/oauth: fix azure_ad user_id and add test and fallback (cherry-pick #8146)
fixsources/oauth: fix URLs being overwritten by OIDC urls (cherry-pick #8147)
fixrbac: fix invitations listing with restricted permissions (cherry-pick #8227)
otherstages/authenticator_validate: use friendly_name for stage selector when enrolling (cherry-pick #8255)
securitysecurity: fix CVE-2024-23647 (cherry-pick #8345)
otherproviders/oauth2: remember session_id from initial token (cherry-pick #7976)
fixoutposts: fix Outpost reconcile not re-assigning managed attribute (cherry-pick #8014)
otherproviders/proxy: use access token (cherry-pick #8022)
otheroutposts: disable deployment and secret reconciler for embedded outpost in code instead of in config (cherry-pick #8021)
fixrbac: fix error when looking up permissions for now uninstalled apps (cherry-pick #8068)
fixweb/flows: fix device picker incorrect foreground color (cherry-pick #8067)
securityproviders/oauth2: fix CVE-2024-21637 (cherry-pick #8104)
othertests: fix flaky tests (cherry-pick #7676)
otherproviders/scim: change familyName default (cherry-pick #7904)
fixweb: fix overflow glitch on ak-page-header (cherry-pick #7883)
fixroot: Fix cache related image build issues (cherry-pick #7831)
fixweb/user: fix search not updating app (cherry-pick #7825)
otherblueprints: improve file change handler (cherry-pick #7813)
otherroot: don't show warning when app has no URLs to import (cherry-pick #7765)
otherstages/email: improve error handling for incorrect template syntax (cherry-pick #7758)
otherevents: include user agent in events (cherry-pick #7693)
featureevents: add better fallback for sanitize_item to ensure everything can be saved as JSON (cherry-pick #7694)
fixproviders/proxy: Fix duplicate cookies when using file system store. (cherry-pick #7541)
otherstages/email: use uuid for email confirmation token instead of username (cherry-pick #7581)
otherevents: sanitize functions (cherry-pick #7587)
fixproviders/scim: fix missing schemas attribute for User and Group (cherry-pick #7477)
fixevents: fix missing model_* events when not directly authenticated (cherry-pick #7588)
otherci: fix permissions for release pipeline to publish binaries (cherry-pick #7512)
othercore: bump golang from 1.21.3-bookworm to 1.21.4-bookworm (cherry-pick #7483)
otherevents: don't update internal service accounts unless needed (cherry-pick #7611)
securitysecurity: fix CVE-2023-48228 (cherry-pick #7666)
otherroot: Improve multi arch Docker image build speed (cherry-pick #7355)
otherproviders/oauth2: set auth_via for token and other endpoints (cherry-pick #7417)
fixstages/email: fix duplicate querystring encoding (cherry-pick #7386)
fixweb/admin: fix html error on oauth2 provider page (cherry-pick #7384)
otherci: explicitly give write permissions to packages (cherry-pick #7428)
fixproviders/proxy: fix closed redis client (cherry-pick #7385)
fixsources/oauth: fix patreon (cherry-pick #7454)
otherweb/flows: attempt to fix bitwareden android compatibility (cherry-pick #7455)
fixevents: fix gdpr compliance always running (cherry-pick #7491)
fixWeb: bugfix: broken backchannel selector (cherry-pick #7480)
fixcore: fix worker beat toggle inverted (cherry-pick #7508)
otherwebsite/docs: update release notes for 2023.10.1
otherweb: bump API Client version
fixstages/email: fix sending emails from task
otherproviders/proxy: attempt to fix duplicate cookie
otherwebsite/blogs: Blog dockers
othercore: bump pydantic-scim from 0.0.7 to 0.0.8
othercore: bump ruff from 0.1.2 to 0.1.3
othercore: bump goauthentik.io/api/v3 from 3.2023083.10 to 3.2023101.1
othercore: bump github.com/google/uuid from 1.3.1 to 1.4.0
fixweb/admin: fix role form reacting to enter
featurewebsite/docs: add warning about upgrading to 2023.10
otherrbac: handle lookup error
fixweb/admin: fix @change handler for ak-radio elements
fixblueprints: fix entries with state: absent not being deleted if their serializer has errors
fixcrypto: fix race conditions when creating self-signed certificates on startup
breakingwebsite/docs: add warning about Helm breaking change in 2024.x
othertranslate: Updates for file web/xliff/en.xlf in zh_CN
othertranslate: Updates for file web/xliff/en.xlf in zh-Hans
otherlifecycle: rework otp_merge migration
breakingwebsite/docs: add missing breaking change due to APPEND_SLASH
otherwebsite/docs: prepare 2023.10.2 release notes
securitysecurity: fix oobe-flow reuse when akadmin is deleted
otherweb: bump API Client version
fixroot: fix pylint errors
fixlifecycle: fix otp merge migration
fixweb/admin: fix application icon size
fixweb/admin: fix circular dependency
fixroot: fix broken celery dependency
fixsources/ldap: fix FreeIPA nsaccountlock sync
featurewebsite/docs: enterprise: add note about upgrading the amount of users
fixstages/password: fix failed_attempts_before_cancel allowing one too m…
breakingflows: remove need for post() wrapper by using dispatch
fixweb/admin: fix not being able to unset certificates
featurewebsite/dev-docs: add raw markdown template
fixsources/ldap: fix task timeout for ldap_sync_all and ldap_sync_single
featurewebsite/docs: add missing word to index.mdx
fixweb/admin: fix flow-search not being able to unset
breakingcore: remove celery's duplicate max_tasks_per_child
fixroot: fix dumb-init
fixroot: fix gunicorn not starting
featureroot: add option to disable beat when running worker
breakingweb: remove ./element⇢./user references
featuresources/ldap: add warning when a property mapping returns None or bytes
featurewebsite/blogs: added emm dashes
featuresources/ldap: add lock to sync
featurewebsite/docs: add info about our docs
featureroot: Add setting to adjust database config for pgpool
breakingroot: remove outdated sponsorship section on readme
featuresources/ldap: add default property mapping to mirror directory structure
featurewebsite/blog: add info-block to blog about m2m
featurewebsite/docs: add notice for nginx ingress configuration requirement
featureweb: add webdriverIO testing layer
featureAdd meta description to black box blog post
featureproviders/saml: add default RelayState value for IDP-initiated requests
featurecore/api: add uuid field to core api user http response
featureproviders/ldap: add windows adsi support
featureweb/admin: add additional Flow info
breakingproviders/scim: remove preview
featurewebsite/docs: added Note in Beta docs
featurestage/deny: add custom message
featurewebsite/integrations: grafana: add Helm and Terraform config examples
featurewebsite/blogs: edited to add 1Password
featureweb/admin: add preview banner to RBAC pages
featurestages/user_write: allow setting user type when creating new user
featurewebsite/docs: add 2023.10 release notes
+318 more items in the release notessecuritysecurity: fix CVE-2024-23647 (cherry-pick #8345)
securityproviders/oauth2: fix CVE-2024-21637 (cherry-pick #8104)
securitysecurity: fix CVE-2023-48228 (cherry-pick #7666)