authentik 2025.10.1 → 2026.2.7
18 releases · 23 breaking changes · 46 security fixes · 12 advisories fixed
46security23breaking5deprecated91feature135fix
Vulnerabilities fixed by this upgrade
- medium CVE-2026-41569 WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints
- 9.3 CVE-2026-42849 Reflected XSS in SFE
- 8.1 CVE-2026-40172 Privilege Escalation via User PATCH: Superuser Group Assignment Bypasses enable_group_superuser
- 7.4 GHSA-3wf5-rj6w-7527 OAuth2 Redirect URI Poisoning via Auto-Save on Unconfigured Provider
- high CVE-2026-40166 Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/
- 8.7 GHSA-5wcc-hf24-rf5h Unauthenticated Access via Client-Controlled X-Original-URI Header in Nginx Forward-Auth Mode
- 8.7 CVE-2026-40165 SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation
- 9.1 CVE-2026-25227 Authenticated Remote Code Execution via Policy/Property Mapping test endpoint
- 8.6 CVE-2026-25748 Forward authentication bypass with malformed session cookie on Traefik and Caddy
- 8.8 CVE-2026-25922 Signature Verification bypass in SAML Source Assertion
- 5.8 CVE-2025-64708 Invitation expiry is delayed by at least 5 minutes
- 4.8 CVE-2025-64521 Deactivated service account can authenticate to OAuth
Breaking changes
- breaking providers/ldap: remove incorrect validation for code authenticator extraction (cherry-pick #23006 to version-2026.2) in 2026.2.5
- breaking endpoints: remove print line (cherry-pick #22325 to version-2026.2) in 2026.2.4
- breaking website/docs: remove broken version tag from oauth doc (cherry-pick #21628 to version-2026.2) in 2026.2.3
- breaking website/docs: remove potatoes card sigh (cherry-pick #20767 to version-2026.2) in 2026.2.2
- breaking endpoints: prevent selection of incompatible connector (cherry-pick #20806 to version-2026.2) in 2026.2.2
- breaking providers/proxy: remove redundant logout event (cherry-pick #20860 to version-2026.2) in 2026.2.2
- breaking events: prevent exception when events contains incompatible unicode (cherry-pick #21048 to version-2026.2) in 2026.2.2
- breaking website/docs: remove bad logs redirect (cherry-pick #20522 to version-2026.2) in 2026.2.1
- breaking core: remove superuser check from Token list in 2026.2.0
- breaking website/docs: 2025.12: remove superfluous changes in 2026.2.0
- breaking stages: remove more global state in 2026.2.0
- breaking website/docs: remove duplicates in slo docs in 2026.2.0
- breaking website/docs: remove "beta" tag from 2025.12 in 2026.2.0
- breaking core: remove session migration in 2026.2.0
- breaking web/elements: remove pfbase everywhere in 2026.2.0
- breaking website/docs: Remove stale 2024 version directives in 2026.2.0
- breaking website/docs: remove redundant RC notice in 2026.2.0
- breaking website/docs: remove bad logs redirect (cherry-pick #20522 to version-2025.12) in 2025.12.5
- breaking website/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.12) in 2025.12.3
- breaking website/docs: remove "beta" tag from 2025.12 (cherry-pick #19404 to version-2025.12) in 2025.12.1
- breaking website/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.10) in 2025.10.4
- breaking website/docs: remove broken info box and fix sentence (cherry-pick #17963 to version-2025.10) in 2025.10.2
- breaking cmd/server/healthcheck: remove worker HTTP healthcheck (cherry-pick #18090 to version-2025.10) in 2025.10.2
Security changes
- security security: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 1919.sec.patch to authentik-2026.2 in 2026.2.6
- security security: automated internal backport of patch 1822.sec.patch to authentik-2026.2 in 2026.2.6
- security security: automated internal backport of patch 1934.sec.patch to authentik-2026.2 in 2026.2.6
- security security: automated internal backport of patch 1887.sec.patch to authentik-2026.2 in 2026.2.6
- security security: automated internal backport of patch 1817.sec.patch to authentik-2026.2 in 2026.2.6
- security website/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2026.2) in 2026.2.4
- security security: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2026.2 in 2026.2.4
- security security: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2026.2 in 2026.2.4
- security security: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2026.2 in 2026.2.4
- security internal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-42849.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-41577.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-41569.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-40172.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-40166.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-40165.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2026.2 in 2026.2.3
- security security: update policy to include explicit intended functionality (cherry-pick #21308 to version-2026.2) in 2026.2.2
- security security: add item to intended behavior section of security policy (cherry-pick #21430 to version-2026.2) in 2026.2.2
- security core: Update supported versions in SECURITY.md in 2026.2.0
- security security: CVE-2026-25922 (2026.2) in 2026.2.0
- security security: CVE-2026-25748 (2026.2) in 2026.2.0
- security security: CVE-2026-25227 (2026.2) in 2026.2.0
- security website/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2025.12) in 2025.12.6
- security security: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2025.12 in 2025.12.6
- security security: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2025.12 in 2025.12.6
- security security: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2025.12 in 2025.12.6
- security internal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: CVE-2026-41577.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: CVE-2026-40172.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: CVE-2026-40166.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: CVE-2026-40165.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: CVE-2026-42849.sec.patch to authentik-2025.12 in 2025.12.5
- security security: CVE-2026-25922 (2025.12) in 2025.12.4
- security security: CVE-2026-25748 (2025.12) in 2025.12.4
- security security: CVE-2026-25227 (2025.12) in 2025.12.4
- security core: Update supported versions in SECURITY.md (cherry-pick #19385 to version-2025.12) in 2025.12.2
- security security: CVE-2026-25922 (2025.10) in 2025.10.4
- security security: CVE-2026-25748 (2025.10) in 2025.10.4
- security security: CVE-2026-25227 (2025.10) in 2025.10.4
Deprecations
- deprecated website/docs: deprecate GCDT auth stage in 2026.2.0
- deprecated web/startup: deprecated theme names break theming in 2026.2.0
- deprecated core: add cause to ak_groups deprecation event and logs (cherry-pick #20361 to version-2026.2) in 2026.2.0
- deprecated web/startup: deprecated theme names break theming (cherry-pick #19431 to version-2025.12) in 2025.12.1
- deprecated website/docs: deprecate GCDT auth stage (cherry-pick #19306 to version-2025.12) in 2025.12.0
Every release in between
otherlifecycle/container: drop curl and runit (cherry-pick #24008 to version-2026.2)
otherpolicies: filter policy engine (cherry-pick #24025 to version-2026.2)
otherci: add working dir prefix to file paths (cherry-pick #24319 to version-2026.2)
fixproviders/scim: fix scim changed detection for nested attributes (cherry-pick #24332 to version-2026.2)
othercore: bump django from 5.2.16 to v5.2.17 (cherry-pick #24793 to version-2026.2)
otherrbac: use constant-time comparison in SecretKeyFilter (cherry-pick #24888 to version-2026.2)
othercore: return the intended status code from error views for all request methods (cherry-pick #24902 to version-2026.2)
otherserver/core: handle unsupported HTTP method (cherry-pick #22498 to version-2026.2)
otherstages/identification: dynamic captcha keys when stage embedded in identification stage (cherry-pick #24079 to version-2026.2)
otherlib: avoid DNS resolution in fqdn_rand (cherry-pick #25728 to version-2026.2)
otherci: bump golangci lint (cherry-pick #25513 to version-2026.2)
securitysecurity: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.2
othertests/openid_conformance: migrate to upstream images (cherry-pick #23828 to version-2026.2)
fixlib/sync/outgoing: fix discover running for each page (cherry-pick #24016 to version-2026.2)
othersources/oauth: improve id_token validation for apple source (cherry-pick #24017 to version-2026.2)
otherpackages/django-dramatiq-postgres/broker: close unusable PostgreSQL connections (cherry-pick #24023 to version-2026.2)
securitysecurity: automated internal backport of patch 1919.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1822.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1934.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1887.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1817.sec.patch to authentik-2026.2
otherwebsite/docs: release notes for 2026.2.6 (cherry-pick #24069 to version-2026.2)
otherwebsite/docs: 2026.2.4 release notes (cherry-pick #22720 to version-2026.2)
otherwebsite/docs: 2025.12.6 release notes (cherry-pick #22719 to version-2026.2)
fixtests/e2e: fix proxy tests failing due to in-use port (cherry-pick #22785 to version-2026.2)
fixweb/admin: fix Docker outpost integration form CA Cert filter (cherry-pick #22863 to version-2026.2)
otherblueprints: handle integrity exception when applying blueprints (cherry-pick #22599 to version-2026.2)
fixendpoints/connectors/agent: fix exception with invalid auth type (cherry-pick #22943 to version-2026.2)
fixproviders/radius: fix panic in log due to type (cherry-pick #22965 to version-2026.2)
othercore: bump django from 5.2.14 to v5.2.15 (cherry-pick #22956 to version-2026.2)
otheradmin/files: sign custom-domain S3 URLs for the final host (cherry-pick #21704 to version-2026.2)
fixpackages/django-postgres-cache: fix naive datetime warning (cherry-pick #23033 to version-2026.2)
fixwebsite/docs: fix 2026.2 release notes docker compose mention take 2 (cherry-pick #23388 to version-2026.2)
otherpolicies: skip cache invalidation on User last_login update (cherry-pick #23159 to version-2026.2)
othertasks: avoid useless query on monitoring_set (cherry-pick #23161 to version-2026.2)
fixpackages/django-dramatiq-postgres/broker: fix race condition in broker causing completed tasks to be repeated (cherry-pick #23218 to version-2026.2)
fixtasks/schedules: fix paused schedules getting unpaused on startup (cherry-pick #23521 to version-2026.2)
otherbrands: select_related models accessed in the hot path (cherry-pick #23162 to version-2026.2)
fixproviders/*: fix missing declaration for can_discover for outgoing sync providers (cherry-pick #23035 to version-2026.2)
othercore: preserve encoded avatar URLs (cherry-pick #23225 to version-2026.2)
fixweb/flows: fix race condition in continuous login and support source stages in authentication flows (cherry-pick #23049 to version-2026.2)
fixweb, core: Fix server-side message race condition, type mismatch. (cherry-pick #23151 to version-2026.2)
fixweb: Fix issue where default user path is not preferred. (cherry-pick #22139 to version-2026.2)
breakingproviders/ldap: remove incorrect validation for code authenticator extraction (cherry-pick #23006 to version-2026.2)
featureproviders/SCIM: Add discover support (cherry-pick #20658 to version-2026.2)
featureproviders/scim: allow failures during discovery (cherry-pick #23357 to version-2026.2)
otherproviders/scim: account for users with no email during discovery (cherry-pick #23417 to version-2026.2)
fixstages/captcha: fix hcaptcha height (#20901) (2026.2)
otherroot: in-process per-IP rate throttle (#23015) (2026.2)
otherci: remove GHA-based cherry-pick (cherry-pick #23801 to version-2026.2)
featurewebsite/docs: add release notes for 2026.2.5 (cherry-pick #23816 to version-2026.2)
breakingendpoints: remove print line (cherry-pick #22325 to version-2026.2)
securitywebsite/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2026.2)
otherenterprise/stages/mtls: freeze time for expired certs (cherry-pick #22411 to version-2026.2)
otherenterprise/stages/mtls: attempt fix freezegun (cherry-pick #22474 to version-2026.2)
fixoutposts: fix stale version in OutpostState (cherry-pick #22487 to version-2026.2)
featurewebsite/docs: add global to values.yaml snippets and update version (cherry-pick #22524 to version-2026.2)
othercore: bump goauthentik/fips-python from 3.14.3-slim-trixie-fips to 3.14.5-slim-trixie-fips in /lifecycle/container (cherry-pick #22518 to version-2026.2)
featureendpoints/connectors/agent: allow federated auth via ssh hostkey lookup (cherry-pick #22594 to version-2026.2)
fixproviders/radius: fix eap debug logging (cherry-pick #22551 to version-2026.2)
fixcore: fix filter_not_expired not accepting positional arguments (2026.2)
otherci: fix docs not having correct js version setup (2026.2)
fixtenants: fix test teardown (version-2026.2)
securitysecurity: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2026.2
othercore: bump django from v5.2.12 to 5.2.13 (cherry-pick #21520 to version-2026.2)
fixendpoints: fix tasks failing (cherry-pick #20904 to version-2026.2)
featurewebsite/docs: add another sentence to First Steps about restricting access to apps (cherry-pick #21517 to version-2026.2)
otherlib/sync/outgoing: avoid expensive query to get number of sync pages (cherry-pick #21575 to version-2026.2)
otherpackages/django-dramatiq-postgres: reset db connections in raise_connection_error (cherry-pick #21577 to version-2026.2)
fixproviders/oauth2: fix time logic in refresh_token_threshold (cherry-pick #21537 to version-2026.2)
fixblueprints: fix reconcile calling @property (cherry-pick #21576 to version-2026.2)
featurewebsite/docs: add a single page about our user interface, document Consent stage (cherry-pick #20533 to version-2026.2)
breakingwebsite/docs: remove broken version tag from oauth doc (cherry-pick #21628 to version-2026.2)
otherweb/flows: prevent leader tab deadlock in continuous login flow (cherry-pick #21583 to version-2026.2)
featureproviders/oauth2: allow cross provider token introspection for federated providers (cherry-pick #21513 to version-2026.2)
otherproviders/oauth2: don't auto-set redirect_uri (cherry-pick #21746 to version-2026.2)
otherci: fix postgres path for postgres 18 tests (2026.2) (#21767)
featurewebsite/docs: add authorization header info to all proxy configs (cherry-pick #21664 to version-2026.2)
otherproviders/oauth2: clip device authorization scope against the provider's ScopeMapping set (cherry-pick #21701 to version-2026.2)
otherwebsite/docs: improve social login docs titles (cherry-pick #21816 to version-2026.2)
fixproviders/radius: fix message authenticator validation (cherry-pick #21824 to version-2026.2)
otherweb/packages: Rework SFE rendering (cherry-pick #21833 to version-2026.2)
fixcore: fix search for app entitlements failing (cherry-pick #21944 to version-2026.2)
otherrbac: ensure migration 0056 runs before 0010 removes group field (cherry-pick #21964 to version-2026.2)
otherroot: update django to 5.2.14 (cherry-pick #22064 to version-2026.2)
otherpackages/django-dramatiq-postgres/broker: avoid task processing stopping on decode error (cherry-pick #22110 to version-2026.2)
othertenants/settings: present unset flags as False (cherry-pick #22162 to version-2026.2)
fixevents: fix destination_group_obj not being nullable (cherry-pick #22161 to version-2026.2)
fixinternal: fix lint
securityinternal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-42849.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-41577.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-41569.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-40172.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-40166.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-40165.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2026.2
otherwebsite/docs: release notes for 2025.12.5 and 2026.2.3 (cherry-pick #22310 to version-2026.2)
otherci: fix reason change in versions repo bump (cherry-pick #20696 to version-2026.2)
otherweb/admin: bad width on policy test results (cherry-pick #20668 to version-2026.2)
otherweb/flows: continuous login (cherry-pick #19862 to version-2026.2)
othercore: bump django from 5.2.11 to 5.2.12 (cherry-pick #20719 to version-2026.2)
otherlifecycle: make gunicorn --max-requests configurable (cherry-pick #20736 to version-2026.2)
otherpackages/django-channels-postgres: provide sync API for group_send (cherry-pick #20740 to version-2026.2)
breakingwebsite/docs: remove potatoes card sigh (cherry-pick #20767 to version-2026.2)
otherwebsite: override DocSearch button colors in light mode (cherry-pick #20770 to version-2026.2)
fixproviders/scim: fix out-of-scope users and groups not being deleted from destination application (cherry-pick #20742 to version-2026.2)
otherproviders/oauth2: decode percent-encoded basic auth (cherry-pick #20779 to version-2026.2)
otherweb/rbac: disambiguate duplicate permission names in initial permissions (cherry-pick #20786 to version-2026.2)
breakingendpoints: prevent selection of incompatible connector (cherry-pick #20806 to version-2026.2)
otherwebsite/docs: update agent docs (cherry-pick #20782 to version-2026.2)
breakingproviders/proxy: remove redundant logout event (cherry-pick #20860 to version-2026.2)
fixweb/admin: Fix SCIM page_size UI issue (cherry-pick #20890 to version-2026.2)
featurelifecycle/migrate: add flag to skip migrations (cherry-pick #20863 to version-2026.2)
fixweb/admin: fix missing OSM referrerPolicy header (cherry-pick #20984 to version-2026.2)
fixwebsite/docs: fix notification transport etc (cherry-pick #20982 to version-2026.2)
fixwebsite/docs: fix swapped sidebar label (cherry-pick #21011 to version-2026.2)
fixsources/ldap: fix incorrect error response for invalid sync_users_password (cherry-pick #21016 to version-2026.2)
featureenterprise/endpoints/connectors/agent: add login_hint support for interactive auth (cherry-pick #20647 to version-2026.2)
fixweb/admin: handle non-string values in formatUUID to prevent Event Log crash (cherry-pick #20804 to version-2026.2)
breakingevents: prevent exception when events contains incompatible unicode (cherry-pick #21048 to version-2026.2)
featurewebsite/docs: add missing dependencies for linux dev environment (cherry-pick #21020 to version-2026.2)
featureproviders/proxy: Add a default maxResponseBodySize to Traefik Middleware (cherry-pick #21111 to version-2026.2)
fixendpoints/connectors: fix enabled flag not respected (cherry-pick #21144 to version-2026.2)
featureweb/applications: add wsfed to app wizard (cherry-pick #20880 to version-2026.2)
featuresources/oauth: Allow patching without provider type (cherry-pick #21211 to version-2026.2)
fixsources/ldap: fix exception in ldap debug endpoint (cherry-pick #21219 to version-2026.2)
featurewebsite/docs: ad source: add note about ldap signing (cherry-pick #21274 to version-2026.2)
fixcore: fix provider not nullable (cherry-pick #21275 to version-2026.2)
fixproviders/saml: Fix redirect for saml slo (cherry-pick #21258 to version-2026.2)
featurewebsite/docs: add example recovery flow with MFA (cherry-pick #19497 to version-2026.2)
featurewebsite/docs: entra scim: add note about validator (cherry-pick #21273 to version-2026.2)
securitysecurity: update policy to include explicit intended functionality (cherry-pick #21308 to version-2026.2)
fixroot: fix compose generation for patch releases release candidates (cherry-pick #21353 to version-2026.2)
fixinternal: fix certificate fallback without SNI (cherry-pick #21417 to version-2026.2)
fixwebsite/docs: fix merge conflict
securitysecurity: add item to intended behavior section of security policy (cherry-pick #21430 to version-2026.2)
featuretasks: allow retry for rejected tasks only (cherry-pick #21433 to version-2026.2)
+24 more items in the release notesotherwebsite/docs: update supported versions (cherry-pick #20534 to version-2026.2)
fixwebsite/docs: fix upgrade link in 2026.2 release notes (cherry-pick #20539 to version-2026.2)
breakingwebsite/docs: remove bad logs redirect (cherry-pick #20522 to version-2026.2)
otherwebsite/docs: revamp enterprise section (cherry-pick #20379 to version-2026.2)
otherdocs: fix typos and wording in docs and integrations (cherry-pick #20550 to version-2026.2)
otherci: add reason change to versions repo bump (cherry-pick #20562 to version-2026.2)
otherinternal: make http timeouts configurable (cherry-pick #20472 to version-2026.2)
otherpackages/django-dramatiq-postgres: use fork (cherry-pick #20606 to version-2026.2)
fixweb/flows: fix source icons being always inverted (cherry-pick #20419 to version-2026.2)
fixcrypto: fix kid legacy signal (cherry-pick #20627 to version-2026.2)
featuresources/ldap: add connection logging & downgrade message (cherry-pick #20519 to version-2026.2)
fixpackages/django-dramatiq-postgres: fix worker startup on macos (cherry-pick #20637 to version-2026.2)
fixenterprise/wsfed: Fix metadata export and signing logic (cherry-pick #20643 to version-2026.2)
featurewebsite/docs: entra id provider: add custom email domain info (cherry-pick #20444 to version-2026.2)
featurewebsite/docs: kerberos: add note about caching (cherry-pick #20663 to version-2026.2)
fixcore: fix get_provider returning base Provider instead of subclass (cherry-pick #19064 to version-2026.2)
otherpackages/django-channels-postgres: eagerly delete messages (cherry-pick #20687 to version-2026.2)
otheroutpost/proxyv2: prevent panic in handleSignOut (cherry-pick #20097 to version-2026.2)
featurewebsite/docs: add 2025 pentest (cherry-pick #20626 to version-2026.2)
fixweb: fix identification stage styling in compatibility mode (cherry-pick #20684 to version-2026.2)
otherproviders/proxy: move search path to query instead of runtime parameter (cherry-pick #20662 to version-2026.2)
featurewebsite/docs: add release notes for 2026.2.1 (cherry-pick #20659 to version-2026.2)
featureroot: Add macOS support for sed in Makefile
featurewebsite/docs: add icon info to style guide
breakingcore: remove superuser check from Token list
featureadmin/files: revert add check for /media existence (#18636)
featurewebsite/docs: add jellyseer integration doc
featurecore: add skip s3_test_server_available to TestResolveFileUrlS3Backend
featurewebsite/docs: Add docs for passkey autofill (WebauthN Conditional UI)
featureweb: add custom message with links for empty data export list
featureweb/admin: endpoint: change wording and add helper text
featurewebsite/docs: added list of Int Guide contributors (also edited frontmatter)
breakingwebsite/docs: 2025.12: remove superfluous changes
featureweb/admin: add UI copy to RBAC modal
breakingstages: remove more global state
featurewebsite/integrations: Add launch URL for Immich
featurewebsite/docs: release notes: add endpoint device links to 2025.12 notes
featurewebsite/docs: add note to active directory source doc
featureblueprints: add InternallyManagedMixin instead of large list
featureenterprise/search: add static autocomplete structure
featurewebsite/integrations: Add Wallos
featuretests/e2e: add endpoint tests
featurewebsite/docs: rel notes .12: add wallos
featurewebsite/docs: endpoint devices: add path to macos setup
featurewebsite/integrations: Add Pulse
featurewebsite/integrations: Add Audiobookshelf
featurewebsite/docs: release notes: Add more integrations
featurewebsite/integrations: vaultwarden: add custom email scope
featureweb/admin: adjust sync threshold, add tooltip
breakingwebsite/docs: remove duplicates in slo docs
deprecatedwebsite/docs: deprecate GCDT auth stage
securitycore: Update supported versions in SECURITY.md
breakingwebsite/docs: remove "beta" tag from 2025.12
breakingcore: remove session migration
deprecatedweb/startup: deprecated theme names break theming
breakingweb/elements: remove pfbase everywhere
breakingwebsite/docs: Remove stale 2024 version directives
breakingwebsite/docs: remove redundant RC notice
securitysecurity: CVE-2026-25922 (2026.2)
securitysecurity: CVE-2026-25748 (2026.2)
securitysecurity: CVE-2026-25227 (2026.2)
deprecatedcore: add cause to ak_groups deprecation event and logs (cherry-pick #20361 to version-2026.2)
+722 more items in the release notessecuritywebsite/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2025.12)
otherenterprise/stages/mtls: freeze time for expired certs (cherry-pick #22411 to version-2025.12)
otherroot: configure freezegun to exclude cryptography (cherry-pick #22442 to version-2025.12)
otherenterprise/stages/mtls: attempt fix freezegun (cherry-pick #22474 to version-2025.12)
fixoutposts: fix stale version in OutpostState (cherry-pick #22487 to version-2025.12)
otherci: fix docs not having correct js version setup (2025.12)
fixtenants: fix test teardown (version-2025.12)
securitysecurity: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2025.12
securitysecurity: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2025.12
securitysecurity: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2025.12
otherwebsite/docs: 2025.10.4 release notes (cherry-pick #20242 to version-2025.12)
otherwebsite/docs: 2025.12.4 release notes (cherry-pick #20226 to version-2025.12)
otherwebsite/docs: 2025.8.6 release notes (cherry-pick #20243 to version-2025.12)
otherci: fix binary outpost build on release (cherry-pick #20248 to version-2025.12)
featurewebsite/docs: add okta source doc (cherry-pick #20296 to version-2025.12)
otherroot: do not rely on npm cli for version bump (cherry-pick #20276 to version-2025.12)
otherci: fix setup altering package-lock (cherry-pick #20348 to version-2025.12)
otherwebsite/docs: Custom CSS (cherry-pick #19991 to version-2025.12)
fixweb: Fix locale selector in compatibility mode. (cherry-pick #19946 to version-2025.12)
othersources/saml: update handling statusmessage (cherry-pick #19739 to version-2025.12)
fixwebsite/docs: Fix broken link to flow executor (cherry-pick #20364 to version-2025.12)
otherci: pull latest changes before tagging new version (cherry-pick #20413 to version-2025.12)
otherwebsite/docs: rac: update rac provider docs (cherry-pick #20225 to version-2025.12)
fixwebsite/docs: fix GitHub social-login wording and capitalization (cherry-pick #20489 to version-2025.12)
featureenterprise: add ES384 to enterprise license algorithms (cherry-pick #20507 to version-2025.12)
fixendpoints: fix infinite recursion in stage with unsupported connector (cherry-pick #20485 to version-2025.12)
fixwebsite/docs: fix linux setup docs (cherry-pick #20508 to version-2025.12)
fixpolicies: fix PolicyEngineMode ALL with static binding optimization (cherry-pick #20430 to version-2025.12)
breakingwebsite/docs: remove bad logs redirect (cherry-pick #20522 to version-2025.12)
fixweb/sfe: bug: polyfill needed to supply Object.assign() to IE11. (cherry-pick #20126 to version-2025.12)
featurewebsite/docs: kerberos: add note about caching (cherry-pick #20663 to version-2025.12)
fixweb/admin: Fix SCIM page_size UI issue (cherry-pick #20890 to version-2025.12)
featureweb/flows: add continuous flow 2025.12
fixweb/admin: fix missing OSM referrerPolicy header (cherry-pick #20984 to version-2025.12)
fixweb/admin: handle non-string values in formatUUID to prevent Event Log crash (cherry-pick #20804 to version-2025.12)
fixsources/ldap: fix exception in ldap debug endpoint (cherry-pick #21219 to version-2025.12)
featurewebsite/docs: add example recovery flow with MFA (cherry-pick #19497 to version-2025.12)
fixroot: fix compose generation for patch releases release candidates (cherry-pick #21353 to version-2025.12)
fixproviders/saml: Fix redirect for saml slo (cherry-pick #21258 to version-2025.12)
featureproviders/oauth2: allow cross provider token introspection for federated providers (cherry-pick #21513 to version-2025.12)
fixproviders/radius: fix message authenticator validation (cherry-pick #21824 to version-2025.12)
fixweb: Fix duplicate Turnstile widgets after extended idle (cherry-pick #21380 to version-2025.12)
fixinternal: fix lint (cherry-pick #22263 to version-2025.12)
securityinternal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: CVE-2026-41577.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: CVE-2026-40172.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: CVE-2026-40166.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: CVE-2026-40165.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: CVE-2026-42849.sec.patch to authentik-2025.12
+23 more items in the release notesfeaturewebsite/docs: Add changes in 2025.12.2 and 2025.12.3 to the release notes (cherry-pick #19949 to version-2025.12)
fixweb/admin: fix default binding order (cherry-pick #19943 to version-2025.12)
otherproviders/oauth2: use compare_digest for client_secret comparison (cherry-pick #19979 to version-2025.12)
otherrecovery: consume token in transaction (cherry-pick #19967 to version-2025.12)
othercore: bump django from 5.2.10 to 5.2.11 (cherry-pick #19988 to version-2025.12)
fixoutposts: fix docker_tls created files permission (cherry-pick #19978 to version-2025.12)
fixwebsite/docs: fix typos (cherry-pick #20000 to version-2025.12)
otherwebsite/docs: endpoint devices: more updates (cherry-pick #19971 to version-2025.12)
otherwebsite/docs: endpoint devices: specify name and slug (cherry-pick #20016 to version-2025.12)
fixwebsite/docs: endpoint devices: fix non debian wording (cherry-pick #20046 to version-2025.12)
otherdocs: add instructions for configuring rp-initiated single logout (cherry-pick #20040 to version-2025.12)
otherwebsite: QL Search keyboard interactions docs, examples. (cherry-pick #16259 to version-2025.12)
otherwebsite/docs: automated install: mention no file:// vars (cherry-pick #20043 to version-2025.12)
otheroutpost/proxyv2: revalidate auth if session fails to load (cherry-pick #18063 to version-2025.12)
otherwebsite/docs: capturing outpost logs (cherry-pick #20045 to version-2025.12)
otherwebsite/docs: endpoint devices: update device authentication location (cherry-pick #20049 to version-2025.12)
otherwebsite/docs: generate CVE sidebar (cherry-pick #20098 to version-2025.12)
fixsources/oauth: Fix InvalidAudienceError in id_token fallback (cherry-pick #20096 to version-2025.12)
featurewebsite/docs: add email verification scope doc (cherry-pick #20141 to version-2025.12)
fixwebsite/docs: rac: fixes the property mapping formatting (cherry-pick #20200 to version-2025.12)
otherwebsite/docs: ssf: update SSF documentation (cherry-pick #20195 to version-2025.12)
securitysecurity: CVE-2026-25922 (2025.12)
securitysecurity: CVE-2026-25748 (2025.12)
securitysecurity: CVE-2026-25227 (2025.12)
otherweb: updated package-lock.json to include missing tree-sitter references (cherry-pick #20244 to version-2025.12)
feature2025.12: Revert bulk revoke added by accident in release branch
fixweb/admin: fix toggle-group for bindings now showing up (cherry-pick #19820 to version-2025.12)
breakingwebsite/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.12)
fixweb: fix Brand CSS not applied to nested Shadow DOM components (cherry-pick #19892 to version-2025.12)
otherci: always generate API clients (#19906)
otherlifecycle/ak: make sure /data has the correct permissions (cherry-pick #19935 to version-2025.12)
featurelifecycle/aws: add /data volume (cherry-pick #19936 to version-2025.12)
otherwebsite/docs: Update location of media storage and outdated references (cherry-pick #19885 to version-2025.12)
fixcore: fix non-expiring service accounts and app passwords (cherry-pick #19913 to version-2025.12)
otherwebsite/docs: release notes: Update release notes for version 2025.12.1 (cherry-pick #19502 to version-2025.12)
featuresources/kerberos: update to new python-kadmin-rs (cherry-pick #19491 to version-2025.12)
featuretests/e2e: Add delay and serialized rollback to saml e2e test (cherry-pick #18840 to version-2025.12)
otherwebsite/docs: endpoint devices: update device code flow instructions (cherry-pick #19528 to version-2025.12)
fixadmin/files: fix manageable check blocking file creation on fresh installs (cherry-pick #19547 to version-2025.12)
fixadmin/files: fix duplicate bucket name in presigned URLs with custom domain (cherry-pick #19537 to version-2025.12)
securitycore: Update supported versions in SECURITY.md (cherry-pick #19385 to version-2025.12)
featurewebsite/docs: add s3 perms (cherry-pick #19579 to version-2025.12)
otherweb: update @goauthentik/api (cherry-pick #19542 to version-2025.12)
fixweb/forms: fix invalid date error for empty datetime-local inputs (cherry-pick #19561 to version-2025.12)
fixendpoints: fix endpoints stage marked as enterprise (cherry-pick #19607 to version-2025.12)
fixpolicies: fix Providers authentication_flow not used when set (cherry-pick #19609 to version-2025.12)
fixproviders/saml: fix structure of encrypted saml assertion (cherry-pick #19592 to version-2025.12)
featureproviders/saml: allow encryption certificates without private keys (cherry-pick #19526 to version-2025.12)
fixsources/saml: Fix signature verification order to accommodate encrypted assertions (cherry-pick #19593 to version-2025.12)
othertests: improve e2e/integration test reliability (cherry-pick #19540 to version-2025.12)
otherlib/sync/outgoing: handle deletions even if object does not exist in database (cherry-pick #18968 to version-2025.12)
otherwebsite/docs: endpoints devices: typo fix (cherry-pick #19621 to version-2025.12)
fixweb/user: fix Firefox for Android infinite render loop in user library (cherry-pick #19379 to version-2025.12)
fixweb/maintenance: fix missing custom web component imports (cherry-pick #18942 to version-2025.12)
otherwebsite/docs: Update saml google workspace guide (cherry-pick #19624 to version-2025.12)
otherwebsite/docs: update endpoint agent windows log location (cherry-pick #19645 to version-2025.12)
featureproviders/oauth2: add logout+jwt token type for oidc logout token. (cherry-pick #19554 to version-2025.12)
fixweb/forms: fix forms not resetting state when modal closes (cherry-pick #19562 to version-2025.12)
fixweb/admin: fix brand form sending "undefined" string for blank default application (cherry-pick #19658 to version-2025.12)
fixinternal: fix incorrect metric calculation (cherry-pick #19701 to version-2025.12)
featuresources/oauth: add fallback for id_token when profile URL is not available (cherry-pick #19311 to version-2025.12)
fixweb/admin: fix impersonation form requesting data without being opened (cherry-pick #19673 to version-2025.12)
featureweb/sfe: downgrade bootstrap, add access denied test (cherry-pick #19763 to version-2025.12)
fixwebsite/docs: fix Transifex link in translation guide (cherry-pick #19735 to version-2025.12)
fixwebsite/docs: endpoint devices: fix local device login (cherry-pick #19698 to version-2025.12)
fixwebsite/docs: Fix authenticator sms docs (cherry-pick #19797 to version-2025.12)
fixproviders/scim: fix email validation mismatch (cherry-pick #19848 to version-2025.12)
fixsources/oauth: Fix an issue where wechat may crash duing login. (cherry-pick #18973 to version-2025.12)
featurewebsite/docs: add more info to entra id scim doc (cherry-pick #19849 to version-2025.12)
featurewebsite/docs: add tip for recovering from accidental main branch work (cherry-pick #19865 to version-2025.12)
featureadmin/files: add centralized theme variable support for file URLs (cherry-pick #19657 to version-2025.12)
fixweb/admin: fix file upload not preserving extension for custom names with dots (cherry-pick #19548 to version-2025.12)
fixweb/admin: fix captcha stage provider selector not showing saved value (cherry-pick #19555 to version-2025.12)
featurewebsite/docs: endpoint devices: add version command (cherry-pick #19767 to version-2025.12)
+14 more items in the release notesbreakingwebsite/docs: remove "beta" tag from 2025.12 (cherry-pick #19404 to version-2025.12)
fixoutposts/ldap: fix build
featurewebsite/docs: add import to discord policy (cherry-pick #19397 to version-2025.12)
otherwebsite/docs: mention dynamic overrides in redirect stage documentation (cherry-pick #19368 to version-2025.12)
otherwebsite/docs: update gws provider docs (cherry-pick #18286 to version-2025.12)
deprecatedweb/startup: deprecated theme names break theming (cherry-pick #19431 to version-2025.12)
otherci: fix checkout stable (for 2025.12) (#19448)
featureproviders/oauth2: allow property mappings to override scope claim in access tokens (cherry-pick #19226 to version-2025.12)
othercore: bump aiohttp from 3.13.2 to v3.13.3 (cherry-pick #19257 to version-2025.12)
otherendpoints/connectors/agent: Skip Endpoint stage on device IA & fix confusing identification subtext (cherry-pick #19482 to version-2025.12)
otherwebsite/docs: limiting permissions of AD service account (cherry-pick #19483 to version-2025.12)
featureendpoints/connectors/agent: add tests for IA endpoint stage (cherry-pick #19487 to version-2025.12)
otherweb: Z-Index Fixes, Mobile Sidebar Behavior. (cherry-pick #19460 to version-2025.12)
fixweb/admin: fix switches (cherry-pick #19493 to version-2025.12)
otherendpoints: include license status in agent config (cherry-pick #19227 to version-2025.12)
otherwebsite/docs: revisit endpoint docs the nth (cherry-pick #19116 to version-2025.12)
otherwebsite/glossary: improve (cherry-pick #18969 to version-2025.12)
fixcore: fix read replica routing during transactions (cherry-pick #19086 to version-2025.12)
otherstages/authenticator_static: set max token length to 100 chars (cherry-pick #19162 to version-2025.12)
fixwebsite: Fix typos. (cherry-pick #19243 to version-2025.12)
otherstages/prompt: optimize API endpoints (cherry-pick #19251 to version-2025.12)
otherstages/password: replace session-based retries with reputation (cherry-pick #18643 to version-2025.12)
featureweb/admin: add banner to flow import form (cherry-pick #19288 to version-2025.12)
othercore: bump urllib3 from 2.5.0 to v2.6.3 (cherry-pick #19287 to version-2025.12)
othercore: bump django from v5.2.9 to 5.2.10 (cherry-pick #19290 to version-2025.12)
otherwebsite/docs: update entra id provider docs (cherry-pick #18366 to version-2025.12)
deprecatedwebsite/docs: deprecate GCDT auth stage (cherry-pick #19306 to version-2025.12)
otherwebsite/docs: update m2m doc (cherry-pick #18963 to version-2025.12)
fixwebsite/docs: Fix documentation example for app_entitlements_attributes. (cherry-pick #19316 to version-2025.12)
featurewebsite/docs: add flow import warnings (cherry-pick #19307 to version-2025.12)
fixwebsite/docs: Fix typo in GitHub OAuth Source instructions (cherry-pick #18936 to version-2025.12)
fixweb: Fix flow inspector advancement event. (cherry-pick #19309 to version-2025.12)
otherwebsite/docs: update github social login script example (cherry-pick #19246 to version-2025.12)
otherwebsite/docs: update unique email policy (cherry-pick #19305 to version-2025.12)
otherweb: Images styles, theming (cherry-pick #19233 to version-2025.12)
otherwebsite/docs: update LDAP provider docs (cherry-pick #18272 to version-2025.12)
otherpackages/django-dramatiq-postgres: broker: empty message after task completed successfully (cherry-pick #19340 to version-2025.12)
otherweb/admin: always retrieve selected provider when editing the application (cherry-pick #19341 to version-2025.12)
otherweb/elements: hidden secrets not propagating (cherry-pick #19029 to version-2025.12)
fixoutpost/proxyv2: fix stale session cookie causing 400 error in createState (cherry-pick #19026 to version-2025.12)
otherwebsite/docs: update location for logs on windows (cherry-pick #19371 to version-2025.12)
otherinternal/outpost: improve PostgreSQL connection options parsing (cherry-pick #19118 to version-2025.12)
otherweb: Flow info, localization, back button. (cherry-pick #19234 to version-2025.12)
otherstages/authenticator_validate: decrease reputation on failed MFA attempt (cherry-pick #19378 to version-2025.12)
otherinternal: rework liveness probe and proxy (cherry-pick #19312 to version-2025.12)
otherweb: UI Locale Fixes (cherry-pick #19235 to version-2025.12)
fixweb/flow: Fix spurious double submit on ak-stage-autosubmit (cherry-pick #18727 to version-2025.10)
featurewebsite/docs: add note to active directory source doc (cherry-pick #18787 to version-2025.10)
otherwebsite/docs: Backport version picker updates. (cherry-pick #18964 to version-2025.10)
fixweb/admin: fix dark theme on map (cherry-pick #18985 to version-2025.10)
fixweb/admin: Fix haveibeenpwned link in PasswordPolicyForm (cherry-pick #18984 to version-2025.10)
othercore: use chunked_queryset for expired message deletion (cherry-pick #19028 to version-2025.10)
otherinternal: update TLS Suite (cherry-pick #19076 to version-2025.10)
fixwebsite/docs: fix build (cherry-pick #19148 to version-2025.10)
fixweb: fix slug auto-updating when editing existing applications (cherry-pick #19169 to version-2025.10)
fixcore: fix read replica routing during transactions (cherry-pick #19086 to version-2025.10)
featureweb/admin: add banner to flow import form (cherry-pick #19288 to version-2025.10)
otherwebsite/docs: update entra id provider docs (cherry-pick #18366 to version-2025.10)
fixwebsite/docs: Fix typo in GitHub OAuth Source instructions (cherry-pick #18936 to version-2025.10)
fixwebsite/docs: Fix documentation example for app_entitlements_attributes. (cherry-pick #19316 to version-2025.10)
otherwebsite/docs: update m2m doc (cherry-pick #18963 to version-2025.10)
otherwebsite/docs: update LDAP provider docs (cherry-pick #18272 to version-2025.10)
otherweb/elements: hidden secrets not propagating (cherry-pick #19029 to version-2025.10)
fixoutpost/proxyv2: fix stale session cookie causing 400 error in createState (cherry-pick #19026 to version-2025.10)
otherinternal: rework liveness probe and proxy (cherry-pick #19312 to version-2025.10)
otherwebsite/docs: update gws provider docs (cherry-pick #18286 to version-2025.10)
featurewebsite/docs: add import to discord policy (cherry-pick #19397 to version-2025.10)
otherwebsite/docs: mention dynamic overrides in redirect stage documentation (cherry-pick #19368 to version-2025.10)
otherwebsite/docs: limiting permissions of AD service account (cherry-pick #19483 to version-2025.10)
featureproviders/oauth2: add logout+jwt token type for oidc logout token. (cherry-pick #19554 to version-2025.10)
fixinternal: fix incorrect metric calculation (cherry-pick #19701 to version-2025.10)
othercore: return bad request when user is authenticated and not active (cherry-pick #19706 to version-2025.10)
fixweb/admin: fix impersonation form requesting data without being opened (cherry-pick #19673 to version-2025.10)
featureweb/sfe: downgrade bootstrap, add access denied test (cherry-pick #19763 to version-2025.10)
fixwebsite/docs: fix Transifex link in translation guide (cherry-pick #19735 to version-2025.10)
otherroot: update client-go generation (cherry-pick #19762 and #19906 to version-2025.10)
otherrecovery: consume token in transaction (cherry-pick #19967 to version-2025.10)
otherproviders/oauth2: use compare_digest for client_secret comparison (cherry-pick #19979 to version-2025.10)
breakingwebsite/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.10)
otherdocs: add instructions for configuring rp-initiated single logout (cherry-pick #20040 to version-2025.10)
othercore: bump django from v5.2.8 to 5.2.11 (version-2025.10)
featurewebsite/docs: add email verification scope doc (cherry-pick #20141 to version-2025.10)
fixwebsite/docs: rac: fixes the property mapping formatting (cherry-pick #20200 to version-2025.10)
securitysecurity: CVE-2026-25922 (2025.10)
securitysecurity: CVE-2026-25748 (2025.10)
securitysecurity: CVE-2026-25227 (2025.10)
+4 more items in the release notesfixwebsite/docs: fix broken link in source switching doc (cherry-pick #18317 to version-2025.10)
otherwebsite/docs: further improvments to source switch doc (cherry-pick #18320 to version-2025.10)
otherwebsite/docs: enhance blueprint docs (cherry-pick #15984 to version-2025.10)
featurewebsite/docs: added missed edits on Blueprints docs (cherry-pick #18321 to version-2025.10)
featurewebsite/docs: add high availability doc (cherry-pick #18182 to version-2025.10)
otherwebsite/docs: update info about docker socket mount (cherry-pick #18344 to version-2025.10)
otheroutposts: set container healthcheck inline (cherry-pick #18298 to version-2025.10)
featureweb/admin: add entitlement search (cherry-pick #18291 to version-2025.10)
otherlib/sync/outgoing: check if there is a provider before creating tasks (cherry-pick #18394 to version-2025.10)
fixweb/admin: fix wording in password stage (cherry-pick #18393 to version-2025.10)
fixweb: Fix stale table rows (cherry-pick #17940 to version-2025.10)
otherweb: revert Fix stale table rows (cherry-pick #17940 to version-2025.10)
otherstages/prompt: set allow_blank for _read_only fields (cherry-pick #18297 to version-2025.10)
fixpackages/django-channels-postgres: fix notify size check (cherry-pick #18347 to version-2025.10)
otherwebsite/docs: improve creds recovery docs (cherry-pick #18385 to version-2025.10)
fixweb/admin: fixes capitalization in application wizard title (cherry-pick #17959 to version-2025.10)
otherwebsite/docs: update certificate doc (cherry-pick #18295 to version-2025.10)
otherproviders/scim: compare users/groups before sending update request (cherry-pick #18456 to version-2025.10)
fixweb/admin: fix brands default switch label (cherry-pick #18518 to version-2025.10)
fixwebsite/docs: expressions: fix markdown (cherry-pick #18613 to version-2025.10)
featurewebsite/docs: adds note about ak_create_jwt function (cherry-pick #18614 to version-2025.10)
otherflows: refresh unauthenticated tabs (cherry-pick #18621 to version-2025.10)
fixroot: fix missing authentik_device cookie causing error (cherry-pick #18642 to version-2025.10)
fixenterprise/stages/mtls: fix traefik certificate parsing (cherry-pick #18607 to version-2025.10)
fixweb: Fix row expansion on modal trigger buttons. (cherry-pick #18412 to version-2025.10)
fixweb/admin: fix event volume chart not updating with query (cherry-pick #18649 to version-2025.10)
othersources/ldap: make server info optional (cherry-pick #18648 to version-2025.10)
fixwebsite/docs: install-config: fix dump_config command (cherry-pick #18659 to version-2025.10)
otherroot: skip current tab when refreshing others (cherry-pick #18674 to version-2025.10)
otherweb: Hide device picker when challenges are not present. (cherry-pick #18611 to version-2025.10)
otherweb: Improved table selection behavior (cherry-pick #18622 to version-2025.10)
featurewebsite/docs: background tasks: add more detail about "next run" (cherry-pick #18660 to version-2025.10)
otheroutpost/proxyv2: more tests, fix pg password with spaces, and existing session on restart (cherry-pick #18211 to version-2025.10)
othercore: optimize list applications (cherry-pick #18330 to version-2025.10)
othercore: list applications fix (cherry-pick #18798 to version-2025.10)
otherpackages/django-dramatiq-postgres: broker: close django connections on consumer close (cherry-pick #18833 to version-2025.10)
featurewebsite/docs: add icon info to style guide (cherry-pick #18832 to version-2025.10)
otherwebsite/docs: 2025.10.3 release notes (cherry-pick #18868 to version-2025.10)
featurebrands: add more matching tests (cherry-pick #16185 to version-2025.10)
otherbrands: sort matched brand by match length (cherry-pick #17920 to version-2025.10)
fixtasks/schedules: fix rel obj not being associated or updated (cherry-pick #17934 to version-2025.10)
featurewebsite/docs: added Note about email_verified scope mapping is set to false by default (cherry-pick #17942 to version-2025.10)
breakingwebsite/docs: remove broken info box and fix sentence (cherry-pick #17963 to version-2025.10)
othercore: bump django from 5.2.7 to 5.2.8 (cherry-pick #17967 to version-2025.10)
otherwebsite/docs: updates img-src csp (cherry-pick #18010 to version-2025.10)
otherci: fix migrate-from-stable for old versions (#18019)
fixwebsite/release notes: fix broken urls (cherry-pick #18041 to version-2025.10)
otherwebsite/docs: update discord social login script example (cherry-pick #18026 to version-2025.10)
otherci: attempt to fix integration tests using dind (cherry-pick #18066 to version-2025.10)
otherci: revert to upstream GHA for release (#18058)
fixevents: fix timezone not set for log events (cherry-pick #18067 to version-2025.10)
featureproviders/scim: allow custom schema data (cherry-pick #18073 to version-2025.10)
othercore: improve app launch URL formatting (cherry-pick #18076 to version-2025.10)
breakingcmd/server/healthcheck: remove worker HTTP healthcheck (cherry-pick #18090 to version-2025.10)
fixweb: Fix RAC modal visibility. (cherry-pick #17941 to version-2025.10)
fixweb: Fix tab activation, blank provider URLs (cherry-pick #18031 to version-2025.10)
fixwebsite/docs: fix wording in stages overview (cherry-pick #18061 to version-2025.10)
otherpackages/django-dramatiq-postgres: broker: ensure locking happens with the same connection (cherry-pick #18095 to version-2025.10)
otherweb/flows: improvements for hCaptcha (cherry-pick #16882 to version-2025.10)
otherweb/admin: link to user on invitation list page (cherry-pick #18132 to version-2025.10)
fixpackages/django-channels-postgres/layer: fix query when subscribed to multiple channels (cherry-pick #18152 to version-2025.10)
otherweb: Disable library on Firefox. (cherry-pick #18103 to version-2025.10)
otherweb/sfe: downgrade bootstrap that was accidentally upgraded (cherry-pick #18157 to version-2025.10)
featurewebsite/docs: Add instructions for installing RC versions (cherry-pick #18099 to version-2025.10)
otherwebsite/docs: update application description (cherry-pick #18125 to version-2025.10)
fixstages/prompt: fix choices with labels causing error on submit (cherry-pick #18183 to version-2025.10)
otherinternal: Automated internal backport: 1487-invitation-expiry.sec.patch to authentik-2025.10
otherinternal: Automated internal backport: 1498-oauth2-cc-user-active.sec.patch to authentik-2025.10
otherinternal: Automated internal backport: 5000-sidebar.sec.patch to authentik-2025.10
featurewebsite/docs: add 2025.8.5 and 2025.10.2 release notes (cherry-pick #18268 to version-2025.10)