authentik 2025.4.0 → 2026.5.3
39 releases · 42 breaking changes · 63 security fixes · 17 advisories fixed
63security42breaking7deprecated171feature241fix
Vulnerabilities fixed by this upgrade
- 8.8 CVE-2026-49443 `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API
- 9.8 CVE-2026-49448 SourceStage bypass via empty POST
- 8.5 CVE-2026-47201 XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user
- medium CVE-2026-41569 WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints
- 9.3 CVE-2026-42849 Reflected XSS in SFE
- 8.1 CVE-2026-40172 Privilege Escalation via User PATCH: Superuser Group Assignment Bypasses enable_group_superuser
- 7.4 GHSA-3wf5-rj6w-7527 OAuth2 Redirect URI Poisoning via Auto-Save on Unconfigured Provider
- high CVE-2026-40166 Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/
- 8.7 GHSA-5wcc-hf24-rf5h Unauthenticated Access via Client-Controlled X-Original-URI Header in Nginx Forward-Auth Mode
- 8.7 CVE-2026-40165 SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation
- 9.1 CVE-2026-25227 Authenticated Remote Code Execution via Policy/Property Mapping test endpoint
- 8.6 CVE-2026-25748 Forward authentication bypass with malformed session cookie on Traefik and Caddy
- 8.8 CVE-2026-25922 Signature Verification bypass in SAML Source Assertion
- 5.8 CVE-2025-64708 Invitation expiry is delayed by at least 5 minutes
- 4.8 CVE-2025-64521 Deactivated service account can authenticate to OAuth
- 7.1 CVE-2025-53942 Insufficient check for account active status when authenticating with OAuth/SAML Sources
- 6.5 CVE-2025-52553 Insufficient Session verification for Remote Access Control endpoint access
Breaking changes
- breaking endpoints: remove print line (cherry-pick #22325 to version-2026.5) in 2026.5.0
- breaking website/integrations: remove sp binding field (cherry-pick #22200 to version-2026.5) in 2026.5.0
- breaking flows: remove link to overview for non-internal user (cherry-pick #22362 to version-2026.5) in 2026.5.0
- breaking providers/ldap: remove incorrect validation for code authenticator extraction (cherry-pick #23006 to version-2026.2) in 2026.2.5
- breaking endpoints: remove print line (cherry-pick #22325 to version-2026.2) in 2026.2.4
- breaking website/docs: remove broken version tag from oauth doc (cherry-pick #21628 to version-2026.2) in 2026.2.3
- breaking website/docs: remove potatoes card sigh (cherry-pick #20767 to version-2026.2) in 2026.2.2
- breaking endpoints: prevent selection of incompatible connector (cherry-pick #20806 to version-2026.2) in 2026.2.2
- breaking providers/proxy: remove redundant logout event (cherry-pick #20860 to version-2026.2) in 2026.2.2
- breaking events: prevent exception when events contains incompatible unicode (cherry-pick #21048 to version-2026.2) in 2026.2.2
- breaking website/docs: remove bad logs redirect (cherry-pick #20522 to version-2026.2) in 2026.2.1
- breaking core: remove superuser check from Token list in 2026.2.0
- breaking website/docs: 2025.12: remove superfluous changes in 2026.2.0
- breaking stages: remove more global state in 2026.2.0
- breaking website/docs: remove duplicates in slo docs in 2026.2.0
- breaking website/docs: remove "beta" tag from 2025.12 in 2026.2.0
- breaking core: remove session migration in 2026.2.0
- breaking web/elements: remove pfbase everywhere in 2026.2.0
- breaking website/docs: Remove stale 2024 version directives in 2026.2.0
- breaking website/docs: remove redundant RC notice in 2026.2.0
- breaking website/docs: remove bad logs redirect (cherry-pick #20522 to version-2025.12) in 2025.12.5
- breaking website/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.12) in 2025.12.3
- breaking website/docs: remove "beta" tag from 2025.12 (cherry-pick #19404 to version-2025.12) in 2025.12.1
- breaking website/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.10) in 2025.10.4
- breaking website/docs: remove broken info box and fix sentence (cherry-pick #17963 to version-2025.10) in 2025.10.2
- breaking cmd/server/healthcheck: remove worker HTTP healthcheck (cherry-pick #18090 to version-2025.10) in 2025.10.2
- breaking outpost: revert breaking signals change (cherry-pick #17847 to version-2025.10) in 2025.10.1
- breaking website/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.8) in 2025.8.6
- breaking policies: remove object pk from authentik_policies_execution_time to reduce cardinality (cherry-pick #16500) in 2025.8.2
- breaking website/docs: remove base providers redirect. (cherry-pick #16576) in 2025.8.2
- breaking tasks: fix status and healthcheck breaking with connection issues (cherry-pick #16504) in 2025.8.2
- breaking website/docs: remove commented out config options (cherry-pick #15064) in 2025.6.2
- breaking website/docs: clarify 2025.4 breaking Reputation changes in 2025.6.0
- breaking website/docs: remove support badge in 2025.6.0
- breaking core: remove OldAuthenticatedSession content type in 2025.6.0
- breaking stages/user_login: remove success message in 2025.6.0
- breaking website/docs: configuration: remove deprecated key for session storage location in 2025.6.0
- breaking website/docs: remove fluff from release notes 2025.6 (cherry-pick #14819) in 2025.6.0
- breaking website/integrations: remove trailing slash from budibase redirect (cherry-pick #14823) in 2025.6.0
- breaking website/docs: remove commented out config options (cherry-pick #15064) in 2025.4.3
- breaking website/docs: clarify 2025.4 breaking Reputation changes (cherry-pick #14284) in 2025.4.2
- breaking core: remove OldAuthenticatedSession content type (cherry-pick #14507) in 2025.4.1
Security changes
- security website/docs: mark cves CVE-2026-49443 and CVE-2026-49448 (cherry-pick #22808 to version-2026.5) in 2026.5.3
- security root: update security release versions (cherry-pick #22583 to version-2026.5) in 2026.5.2
- security security: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2026.5 in 2026.5.2
- security security: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2026.5 in 2026.5.2
- security security: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2026.5 in 2026.5.2
- security website/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2026.5) in 2026.5.0
- security security: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 1919.sec.patch to authentik-2026.2 in 2026.2.6
- security security: automated internal backport of patch 1822.sec.patch to authentik-2026.2 in 2026.2.6
- security security: automated internal backport of patch 1934.sec.patch to authentik-2026.2 in 2026.2.6
- security security: automated internal backport of patch 1887.sec.patch to authentik-2026.2 in 2026.2.6
- security security: automated internal backport of patch 1817.sec.patch to authentik-2026.2 in 2026.2.6
- security website/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2026.2) in 2026.2.4
- security security: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2026.2 in 2026.2.4
- security security: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2026.2 in 2026.2.4
- security security: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2026.2 in 2026.2.4
- security internal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-42849.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-41577.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-41569.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-40172.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-40166.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-40165.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2026.2 in 2026.2.3
- security security: update policy to include explicit intended functionality (cherry-pick #21308 to version-2026.2) in 2026.2.2
- security security: add item to intended behavior section of security policy (cherry-pick #21430 to version-2026.2) in 2026.2.2
- security core: Update supported versions in SECURITY.md in 2026.2.0
- security security: CVE-2026-25922 (2026.2) in 2026.2.0
- security security: CVE-2026-25748 (2026.2) in 2026.2.0
- security security: CVE-2026-25227 (2026.2) in 2026.2.0
- security website/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2025.12) in 2025.12.6
- security security: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2025.12 in 2025.12.6
- security security: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2025.12 in 2025.12.6
- security security: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2025.12 in 2025.12.6
- security internal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: CVE-2026-41577.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: CVE-2026-40172.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: CVE-2026-40166.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: CVE-2026-40165.sec.patch to authentik-2025.12 in 2025.12.5
- security internal: Automated internal backport: CVE-2026-42849.sec.patch to authentik-2025.12 in 2025.12.5
- security security: CVE-2026-25922 (2025.12) in 2025.12.4
- security security: CVE-2026-25748 (2025.12) in 2025.12.4
- security security: CVE-2026-25227 (2025.12) in 2025.12.4
- security core: Update supported versions in SECURITY.md (cherry-pick #19385 to version-2025.12) in 2025.12.2
- security security: CVE-2026-25922 (2025.10) in 2025.10.4
- security security: CVE-2026-25748 (2025.10) in 2025.10.4
- security security: CVE-2026-25227 (2025.10) in 2025.10.4
- security security: CVE-2026-25922 (2025.8) in 2025.8.6
- security security: CVE-2026-25748 (2025.8) in 2025.8.6
- security security: CVE-2026-25227 (2025.8) in 2025.8.6
- security root: update security.md with github reporting link (cherry-pick #16332) in 2025.8.2
- security root: fix security.md (cherry-pick #16345) in 2025.8.2
- security security: Bump supported versions (cherry-pick #16261) in 2025.8.0
- security Fixes CVE-2025-53942: Insufficient check for account active status when authenticating with OAuth/SAML Sources in 2025.6.4
- security security: fix CVE-2025-52553 (cherry-pick #15289) in 2025.6.3
- security website/integrations: add push security in 2025.6.0
- security Fixes CVE-2025-53942: Insufficient check for account active status when authenticating with OAuth/SAML Sources in 2025.4.4
- security Fixes CVE-2025-52553: Insufficient Session verification for Remote Access Control endpoint access in 2025.4.3
Deprecations
- deprecated website/docs: deprecate GCDT auth stage in 2026.2.0
- deprecated web/startup: deprecated theme names break theming in 2026.2.0
- deprecated core: add cause to ak_groups deprecation event and logs (cherry-pick #20361 to version-2026.2) in 2026.2.0
- deprecated web/startup: deprecated theme names break theming (cherry-pick #19431 to version-2025.12) in 2025.12.1
- deprecated website/docs: deprecate GCDT auth stage (cherry-pick #19306 to version-2025.12) in 2025.12.0
- deprecated internal: fix go deprecation for +build (cherry-pick #17806 to version-2025.10) in 2025.10.1
- deprecated website/integrations: minio: notice about sso deprecation on CE in 2025.6.0
Every release in between
otherwebsite/docs: 2026.5.2 release notes (cherry-pick #22721 to version-2026.5)
otherwebsite/docs: 2026.2.4 release notes (cherry-pick #22720 to version-2026.5)
otherwebsite/docs: 2025.12.6 release notes (cherry-pick #22719 to version-2026.5)
otherwebsite/docs: update endpoint SSH docs (cherry-pick #22759 to version-2026.5)
fixtests/e2e: fix proxy tests failing due to in-use port (cherry-pick #22785 to version-2026.5)
fixenterprise/providers/scim: fix interactive OAuth overriding refresh_token (cherry-pick #22858 to version-2026.5)
securitywebsite/docs: mark cves CVE-2026-49443 and CVE-2026-49448 (cherry-pick #22808 to version-2026.5)
featurewebsite/docs: add oidc issuer information (cherry-pick #22556 to version-2026.5)
otherwebsite/docs: update binding wizard labels (cherry-pick #22869 to version-2026.5)
fixweb/admin: fix Docker outpost integration form CA Cert filter (cherry-pick #22863 to version-2026.5)
otherblueprints: handle integrity exception when applying blueprints (cherry-pick #22599 to version-2026.5)
otherwebsite/docs: clean up proxy provider docs (cherry-pick #22870 to version-2026.5)
fixendpoints/connectors/agent: fix exception with invalid auth type (cherry-pick #22943 to version-2026.5)
fixproviders/radius: fix panic in log due to type (cherry-pick #22965 to version-2026.5)
fixwebsite: fix package-lock.json (version-2026.5)
otherweb/polyfill: polyfill customElements.getName for Safari < 17.4 (cherry-pick #22940 to version-2026.5)
othercore: bump django from 5.2.14 to v5.2.15 (cherry-pick #22956 to version-2026.5)
otherproviders/oauth: skip post logout redirect matching if none are saved on the provider (cherry-pick #22718 to version-2026.5)
featurewebsite/docs: add release notes for 2026.5.3 (cherry-pick #22976 to version-2026.5)
fixwebsite/docs: Fix release notes cards (cherry-pick #22554 to version-2026.5)
securityroot: update security release versions (cherry-pick #22583 to version-2026.5)
featureendpoints/connectors/agent: allow federated auth via ssh hostkey lookup (cherry-pick #22594 to version-2026.5)
otherwebsite/docs: Bump package-lock
fixproviders/radius: fix eap debug logging (cherry-pick #22551 to version-2026.5)
fixevents: fix Event.log_deprecation not checking that cause is a string (cherry-pick #22598 to version-2026.5)
fixpackages/ak-common/db: fix conn_max_age causing spinning (cherry-pick #22679 to version-2026.5)
fixpackages/ak-common/db: fix certificates options not allowing file paths (cherry-pick #22680 to version-2026.5)
fixproviders/oauth2: fix session decode when upgrading from 2026.2 (cherry-pick #22684 to version-2026.5)
fixenterprise/providers/scim: fix last_updated for OAuth interactive (cherry-pick #22678 to version-2026.5)
securitysecurity: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2026.5
breakingendpoints: remove print line (cherry-pick #22325 to version-2026.5)
featurewebsite/docs: release notes 2026.5: add section about package reduction (cherry-pick #22308 to version-2026.5)
securitywebsite/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2026.5)
featureenterprise/providers/scim: add support for interactive OAuth2 (cherry-pick #22072 to version-2026.5)
fixwebsite/docs: fix typos and style issues (cherry-pick #22141 to version-2026.5)
otherwebsite/integrations: Update all guides to match auto generated issuer (cherry-pick #22180 to version-2026.5)
breakingwebsite/integrations: remove sp binding field (cherry-pick #22200 to version-2026.5)
fixwebsite/docs: 2026.5 release notes: fix performance improvements wording (cherry-pick #22307 to version-2026.5)
fixweb: Fix issue where default user path is not preferred. (cherry-pick #22139 to version-2026.5)
featurewebsite/docs: Add invitation wizard docs (cherry-pick #22069 to version-2026.5)
otherwebsite/docs, integrations: SAML docs endpoint updates (cherry-pick #22197 to version-2026.5)
featureproviders/saml: Add sls to saml overview (cherry-pick #22183 to version-2026.5)
breakingflows: remove link to overview for non-internal user (cherry-pick #22362 to version-2026.5)
otherenterprise/stages/mtls: freeze time for expired certs (cherry-pick #22411 to version-2026.5)
featurewebsite: Docs and README new screenshots (cherry-pick #22341 to version-2026.5)
otherweb, website: Update name to application dashboard (cherry-pick #22190 to version-2026.5)
otherweb/table: fetch on first render when already visible (cherry-pick #22376 to version-2026.5)
otherwebsite/docs: providers: update UI terms (cherry-pick #22136 to version-2026.5)
otherproviders/saml: Properly import audience from metadata. (cherry-pick #22181 to version-2026.5)
featurewebsite/docs: add integrations to 2026.5 release notes (cherry-pick #22416 to version-2026.5)
otherroot: configure freezegun to exclude cryptography (cherry-pick #22442 to version-2026.5)
featurewebsite/docs: first batch of updates for new Binding wizard (cherry-pick #22393 to version-2026.5)
fixroot: fix gitignore binary paths (cherry-pick #22445 to version-2026.5)
otherenterprise/stages/mtls: attempt fix freezegun (cherry-pick #22474 to version-2026.5)
fixoutposts: fix stale version in OutpostState (cherry-pick #22487 to version-2026.5)
otherwebsite/docs: update saml source to include details on force authenti… (cherry-pick #22488 to version-2026.5)
featurewebsite/docs: add global to values.yaml snippets and update version (cherry-pick #22524 to version-2026.5)
othercore: bump goauthentik/fips-python from 3.14.3-slim-trixie-fips to 3.14.5-slim-trixie-fips in /lifecycle/container (cherry-pick #22518 to version-2026.5)
featurewebsite/docs: release notes: add absorb lms to integrations (cherry-pick #22534 to version-2026.5)
otherproviders/saml: handle XML declarations in unified endpoint (cherry-pick #22455 to version-2026.5)
fixevents: fix certificate typo (cherry-pick #22542 to version-2026.5)
otherwebsite/release: Release notes updates (cherry-pick #22543 to version-2026.5)
otherlifecycle/container: drop curl and runit (cherry-pick #24008 to version-2026.2)
otherpolicies: filter policy engine (cherry-pick #24025 to version-2026.2)
otherci: add working dir prefix to file paths (cherry-pick #24319 to version-2026.2)
fixproviders/scim: fix scim changed detection for nested attributes (cherry-pick #24332 to version-2026.2)
othercore: bump django from 5.2.16 to v5.2.17 (cherry-pick #24793 to version-2026.2)
otherrbac: use constant-time comparison in SecretKeyFilter (cherry-pick #24888 to version-2026.2)
othercore: return the intended status code from error views for all request methods (cherry-pick #24902 to version-2026.2)
otherserver/core: handle unsupported HTTP method (cherry-pick #22498 to version-2026.2)
otherstages/identification: dynamic captcha keys when stage embedded in identification stage (cherry-pick #24079 to version-2026.2)
otherlib: avoid DNS resolution in fqdn_rand (cherry-pick #25728 to version-2026.2)
otherci: bump golangci lint (cherry-pick #25513 to version-2026.2)
securitysecurity: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.2
othertests/openid_conformance: migrate to upstream images (cherry-pick #23828 to version-2026.2)
fixlib/sync/outgoing: fix discover running for each page (cherry-pick #24016 to version-2026.2)
othersources/oauth: improve id_token validation for apple source (cherry-pick #24017 to version-2026.2)
otherpackages/django-dramatiq-postgres/broker: close unusable PostgreSQL connections (cherry-pick #24023 to version-2026.2)
securitysecurity: automated internal backport of patch 1919.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1822.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1934.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1887.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1817.sec.patch to authentik-2026.2
otherwebsite/docs: release notes for 2026.2.6 (cherry-pick #24069 to version-2026.2)
otherwebsite/docs: 2026.2.4 release notes (cherry-pick #22720 to version-2026.2)
otherwebsite/docs: 2025.12.6 release notes (cherry-pick #22719 to version-2026.2)
fixtests/e2e: fix proxy tests failing due to in-use port (cherry-pick #22785 to version-2026.2)
fixweb/admin: fix Docker outpost integration form CA Cert filter (cherry-pick #22863 to version-2026.2)
otherblueprints: handle integrity exception when applying blueprints (cherry-pick #22599 to version-2026.2)
fixendpoints/connectors/agent: fix exception with invalid auth type (cherry-pick #22943 to version-2026.2)
fixproviders/radius: fix panic in log due to type (cherry-pick #22965 to version-2026.2)
othercore: bump django from 5.2.14 to v5.2.15 (cherry-pick #22956 to version-2026.2)
otheradmin/files: sign custom-domain S3 URLs for the final host (cherry-pick #21704 to version-2026.2)
fixpackages/django-postgres-cache: fix naive datetime warning (cherry-pick #23033 to version-2026.2)
fixwebsite/docs: fix 2026.2 release notes docker compose mention take 2 (cherry-pick #23388 to version-2026.2)
otherpolicies: skip cache invalidation on User last_login update (cherry-pick #23159 to version-2026.2)
othertasks: avoid useless query on monitoring_set (cherry-pick #23161 to version-2026.2)
fixpackages/django-dramatiq-postgres/broker: fix race condition in broker causing completed tasks to be repeated (cherry-pick #23218 to version-2026.2)
fixtasks/schedules: fix paused schedules getting unpaused on startup (cherry-pick #23521 to version-2026.2)
otherbrands: select_related models accessed in the hot path (cherry-pick #23162 to version-2026.2)
fixproviders/*: fix missing declaration for can_discover for outgoing sync providers (cherry-pick #23035 to version-2026.2)
othercore: preserve encoded avatar URLs (cherry-pick #23225 to version-2026.2)
fixweb/flows: fix race condition in continuous login and support source stages in authentication flows (cherry-pick #23049 to version-2026.2)
fixweb, core: Fix server-side message race condition, type mismatch. (cherry-pick #23151 to version-2026.2)
fixweb: Fix issue where default user path is not preferred. (cherry-pick #22139 to version-2026.2)
breakingproviders/ldap: remove incorrect validation for code authenticator extraction (cherry-pick #23006 to version-2026.2)
featureproviders/SCIM: Add discover support (cherry-pick #20658 to version-2026.2)
featureproviders/scim: allow failures during discovery (cherry-pick #23357 to version-2026.2)
otherproviders/scim: account for users with no email during discovery (cherry-pick #23417 to version-2026.2)
fixstages/captcha: fix hcaptcha height (#20901) (2026.2)
otherroot: in-process per-IP rate throttle (#23015) (2026.2)
otherci: remove GHA-based cherry-pick (cherry-pick #23801 to version-2026.2)
featurewebsite/docs: add release notes for 2026.2.5 (cherry-pick #23816 to version-2026.2)
breakingendpoints: remove print line (cherry-pick #22325 to version-2026.2)
securitywebsite/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2026.2)
otherenterprise/stages/mtls: freeze time for expired certs (cherry-pick #22411 to version-2026.2)
otherenterprise/stages/mtls: attempt fix freezegun (cherry-pick #22474 to version-2026.2)
fixoutposts: fix stale version in OutpostState (cherry-pick #22487 to version-2026.2)
featurewebsite/docs: add global to values.yaml snippets and update version (cherry-pick #22524 to version-2026.2)
othercore: bump goauthentik/fips-python from 3.14.3-slim-trixie-fips to 3.14.5-slim-trixie-fips in /lifecycle/container (cherry-pick #22518 to version-2026.2)
featureendpoints/connectors/agent: allow federated auth via ssh hostkey lookup (cherry-pick #22594 to version-2026.2)
fixproviders/radius: fix eap debug logging (cherry-pick #22551 to version-2026.2)
fixcore: fix filter_not_expired not accepting positional arguments (2026.2)
otherci: fix docs not having correct js version setup (2026.2)
fixtenants: fix test teardown (version-2026.2)
securitysecurity: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2026.2
othercore: bump django from v5.2.12 to 5.2.13 (cherry-pick #21520 to version-2026.2)
fixendpoints: fix tasks failing (cherry-pick #20904 to version-2026.2)
featurewebsite/docs: add another sentence to First Steps about restricting access to apps (cherry-pick #21517 to version-2026.2)
otherlib/sync/outgoing: avoid expensive query to get number of sync pages (cherry-pick #21575 to version-2026.2)
otherpackages/django-dramatiq-postgres: reset db connections in raise_connection_error (cherry-pick #21577 to version-2026.2)
fixproviders/oauth2: fix time logic in refresh_token_threshold (cherry-pick #21537 to version-2026.2)
fixblueprints: fix reconcile calling @property (cherry-pick #21576 to version-2026.2)
featurewebsite/docs: add a single page about our user interface, document Consent stage (cherry-pick #20533 to version-2026.2)
breakingwebsite/docs: remove broken version tag from oauth doc (cherry-pick #21628 to version-2026.2)
otherweb/flows: prevent leader tab deadlock in continuous login flow (cherry-pick #21583 to version-2026.2)
featureproviders/oauth2: allow cross provider token introspection for federated providers (cherry-pick #21513 to version-2026.2)
otherproviders/oauth2: don't auto-set redirect_uri (cherry-pick #21746 to version-2026.2)
otherci: fix postgres path for postgres 18 tests (2026.2) (#21767)
featurewebsite/docs: add authorization header info to all proxy configs (cherry-pick #21664 to version-2026.2)
otherproviders/oauth2: clip device authorization scope against the provider's ScopeMapping set (cherry-pick #21701 to version-2026.2)
otherwebsite/docs: improve social login docs titles (cherry-pick #21816 to version-2026.2)
fixproviders/radius: fix message authenticator validation (cherry-pick #21824 to version-2026.2)
otherweb/packages: Rework SFE rendering (cherry-pick #21833 to version-2026.2)
fixcore: fix search for app entitlements failing (cherry-pick #21944 to version-2026.2)
otherrbac: ensure migration 0056 runs before 0010 removes group field (cherry-pick #21964 to version-2026.2)
otherroot: update django to 5.2.14 (cherry-pick #22064 to version-2026.2)
otherpackages/django-dramatiq-postgres/broker: avoid task processing stopping on decode error (cherry-pick #22110 to version-2026.2)
othertenants/settings: present unset flags as False (cherry-pick #22162 to version-2026.2)
fixevents: fix destination_group_obj not being nullable (cherry-pick #22161 to version-2026.2)
fixinternal: fix lint
securityinternal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-42849.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-41577.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-41569.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-40172.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-40166.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-40165.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2026.2
otherwebsite/docs: release notes for 2025.12.5 and 2026.2.3 (cherry-pick #22310 to version-2026.2)
otherci: fix reason change in versions repo bump (cherry-pick #20696 to version-2026.2)
otherweb/admin: bad width on policy test results (cherry-pick #20668 to version-2026.2)
otherweb/flows: continuous login (cherry-pick #19862 to version-2026.2)
othercore: bump django from 5.2.11 to 5.2.12 (cherry-pick #20719 to version-2026.2)
otherlifecycle: make gunicorn --max-requests configurable (cherry-pick #20736 to version-2026.2)
otherpackages/django-channels-postgres: provide sync API for group_send (cherry-pick #20740 to version-2026.2)
breakingwebsite/docs: remove potatoes card sigh (cherry-pick #20767 to version-2026.2)
otherwebsite: override DocSearch button colors in light mode (cherry-pick #20770 to version-2026.2)
fixproviders/scim: fix out-of-scope users and groups not being deleted from destination application (cherry-pick #20742 to version-2026.2)
otherproviders/oauth2: decode percent-encoded basic auth (cherry-pick #20779 to version-2026.2)
otherweb/rbac: disambiguate duplicate permission names in initial permissions (cherry-pick #20786 to version-2026.2)
breakingendpoints: prevent selection of incompatible connector (cherry-pick #20806 to version-2026.2)
otherwebsite/docs: update agent docs (cherry-pick #20782 to version-2026.2)
breakingproviders/proxy: remove redundant logout event (cherry-pick #20860 to version-2026.2)
fixweb/admin: Fix SCIM page_size UI issue (cherry-pick #20890 to version-2026.2)
featurelifecycle/migrate: add flag to skip migrations (cherry-pick #20863 to version-2026.2)
fixweb/admin: fix missing OSM referrerPolicy header (cherry-pick #20984 to version-2026.2)
fixwebsite/docs: fix notification transport etc (cherry-pick #20982 to version-2026.2)
fixwebsite/docs: fix swapped sidebar label (cherry-pick #21011 to version-2026.2)
fixsources/ldap: fix incorrect error response for invalid sync_users_password (cherry-pick #21016 to version-2026.2)
featureenterprise/endpoints/connectors/agent: add login_hint support for interactive auth (cherry-pick #20647 to version-2026.2)
fixweb/admin: handle non-string values in formatUUID to prevent Event Log crash (cherry-pick #20804 to version-2026.2)
breakingevents: prevent exception when events contains incompatible unicode (cherry-pick #21048 to version-2026.2)
featurewebsite/docs: add missing dependencies for linux dev environment (cherry-pick #21020 to version-2026.2)
featureproviders/proxy: Add a default maxResponseBodySize to Traefik Middleware (cherry-pick #21111 to version-2026.2)
fixendpoints/connectors: fix enabled flag not respected (cherry-pick #21144 to version-2026.2)
featureweb/applications: add wsfed to app wizard (cherry-pick #20880 to version-2026.2)
featuresources/oauth: Allow patching without provider type (cherry-pick #21211 to version-2026.2)
fixsources/ldap: fix exception in ldap debug endpoint (cherry-pick #21219 to version-2026.2)
featurewebsite/docs: ad source: add note about ldap signing (cherry-pick #21274 to version-2026.2)
fixcore: fix provider not nullable (cherry-pick #21275 to version-2026.2)
fixproviders/saml: Fix redirect for saml slo (cherry-pick #21258 to version-2026.2)
featurewebsite/docs: add example recovery flow with MFA (cherry-pick #19497 to version-2026.2)
featurewebsite/docs: entra scim: add note about validator (cherry-pick #21273 to version-2026.2)
securitysecurity: update policy to include explicit intended functionality (cherry-pick #21308 to version-2026.2)
fixroot: fix compose generation for patch releases release candidates (cherry-pick #21353 to version-2026.2)
fixinternal: fix certificate fallback without SNI (cherry-pick #21417 to version-2026.2)
fixwebsite/docs: fix merge conflict
securitysecurity: add item to intended behavior section of security policy (cherry-pick #21430 to version-2026.2)
featuretasks: allow retry for rejected tasks only (cherry-pick #21433 to version-2026.2)
+24 more items in the release notesotherwebsite/docs: update supported versions (cherry-pick #20534 to version-2026.2)
fixwebsite/docs: fix upgrade link in 2026.2 release notes (cherry-pick #20539 to version-2026.2)
breakingwebsite/docs: remove bad logs redirect (cherry-pick #20522 to version-2026.2)
otherwebsite/docs: revamp enterprise section (cherry-pick #20379 to version-2026.2)
otherdocs: fix typos and wording in docs and integrations (cherry-pick #20550 to version-2026.2)
otherci: add reason change to versions repo bump (cherry-pick #20562 to version-2026.2)
otherinternal: make http timeouts configurable (cherry-pick #20472 to version-2026.2)
otherpackages/django-dramatiq-postgres: use fork (cherry-pick #20606 to version-2026.2)
fixweb/flows: fix source icons being always inverted (cherry-pick #20419 to version-2026.2)
fixcrypto: fix kid legacy signal (cherry-pick #20627 to version-2026.2)
featuresources/ldap: add connection logging & downgrade message (cherry-pick #20519 to version-2026.2)
fixpackages/django-dramatiq-postgres: fix worker startup on macos (cherry-pick #20637 to version-2026.2)
fixenterprise/wsfed: Fix metadata export and signing logic (cherry-pick #20643 to version-2026.2)
featurewebsite/docs: entra id provider: add custom email domain info (cherry-pick #20444 to version-2026.2)
featurewebsite/docs: kerberos: add note about caching (cherry-pick #20663 to version-2026.2)
fixcore: fix get_provider returning base Provider instead of subclass (cherry-pick #19064 to version-2026.2)
otherpackages/django-channels-postgres: eagerly delete messages (cherry-pick #20687 to version-2026.2)
otheroutpost/proxyv2: prevent panic in handleSignOut (cherry-pick #20097 to version-2026.2)
featurewebsite/docs: add 2025 pentest (cherry-pick #20626 to version-2026.2)
fixweb: fix identification stage styling in compatibility mode (cherry-pick #20684 to version-2026.2)
otherproviders/proxy: move search path to query instead of runtime parameter (cherry-pick #20662 to version-2026.2)
featurewebsite/docs: add release notes for 2026.2.1 (cherry-pick #20659 to version-2026.2)
featureroot: Add macOS support for sed in Makefile
featurewebsite/docs: add icon info to style guide
breakingcore: remove superuser check from Token list
featureadmin/files: revert add check for /media existence (#18636)
featurewebsite/docs: add jellyseer integration doc
featurecore: add skip s3_test_server_available to TestResolveFileUrlS3Backend
featurewebsite/docs: Add docs for passkey autofill (WebauthN Conditional UI)
featureweb: add custom message with links for empty data export list
featureweb/admin: endpoint: change wording and add helper text
featurewebsite/docs: added list of Int Guide contributors (also edited frontmatter)
breakingwebsite/docs: 2025.12: remove superfluous changes
featureweb/admin: add UI copy to RBAC modal
breakingstages: remove more global state
featurewebsite/integrations: Add launch URL for Immich
featurewebsite/docs: release notes: add endpoint device links to 2025.12 notes
featurewebsite/docs: add note to active directory source doc
featureblueprints: add InternallyManagedMixin instead of large list
featureenterprise/search: add static autocomplete structure
featurewebsite/integrations: Add Wallos
featuretests/e2e: add endpoint tests
featurewebsite/docs: rel notes .12: add wallos
featurewebsite/docs: endpoint devices: add path to macos setup
featurewebsite/integrations: Add Pulse
featurewebsite/integrations: Add Audiobookshelf
featurewebsite/docs: release notes: Add more integrations
featurewebsite/integrations: vaultwarden: add custom email scope
featureweb/admin: adjust sync threshold, add tooltip
breakingwebsite/docs: remove duplicates in slo docs
deprecatedwebsite/docs: deprecate GCDT auth stage
securitycore: Update supported versions in SECURITY.md
breakingwebsite/docs: remove "beta" tag from 2025.12
breakingcore: remove session migration
deprecatedweb/startup: deprecated theme names break theming
breakingweb/elements: remove pfbase everywhere
breakingwebsite/docs: Remove stale 2024 version directives
breakingwebsite/docs: remove redundant RC notice
securitysecurity: CVE-2026-25922 (2026.2)
securitysecurity: CVE-2026-25748 (2026.2)
securitysecurity: CVE-2026-25227 (2026.2)
deprecatedcore: add cause to ak_groups deprecation event and logs (cherry-pick #20361 to version-2026.2)
+722 more items in the release notessecuritywebsite/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2025.12)
otherenterprise/stages/mtls: freeze time for expired certs (cherry-pick #22411 to version-2025.12)
otherroot: configure freezegun to exclude cryptography (cherry-pick #22442 to version-2025.12)
otherenterprise/stages/mtls: attempt fix freezegun (cherry-pick #22474 to version-2025.12)
fixoutposts: fix stale version in OutpostState (cherry-pick #22487 to version-2025.12)
otherci: fix docs not having correct js version setup (2025.12)
fixtenants: fix test teardown (version-2025.12)
securitysecurity: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2025.12
securitysecurity: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2025.12
securitysecurity: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2025.12
otherwebsite/docs: 2025.10.4 release notes (cherry-pick #20242 to version-2025.12)
otherwebsite/docs: 2025.12.4 release notes (cherry-pick #20226 to version-2025.12)
otherwebsite/docs: 2025.8.6 release notes (cherry-pick #20243 to version-2025.12)
otherci: fix binary outpost build on release (cherry-pick #20248 to version-2025.12)
featurewebsite/docs: add okta source doc (cherry-pick #20296 to version-2025.12)
otherroot: do not rely on npm cli for version bump (cherry-pick #20276 to version-2025.12)
otherci: fix setup altering package-lock (cherry-pick #20348 to version-2025.12)
otherwebsite/docs: Custom CSS (cherry-pick #19991 to version-2025.12)
fixweb: Fix locale selector in compatibility mode. (cherry-pick #19946 to version-2025.12)
othersources/saml: update handling statusmessage (cherry-pick #19739 to version-2025.12)
fixwebsite/docs: Fix broken link to flow executor (cherry-pick #20364 to version-2025.12)
otherci: pull latest changes before tagging new version (cherry-pick #20413 to version-2025.12)
otherwebsite/docs: rac: update rac provider docs (cherry-pick #20225 to version-2025.12)
fixwebsite/docs: fix GitHub social-login wording and capitalization (cherry-pick #20489 to version-2025.12)
featureenterprise: add ES384 to enterprise license algorithms (cherry-pick #20507 to version-2025.12)
fixendpoints: fix infinite recursion in stage with unsupported connector (cherry-pick #20485 to version-2025.12)
fixwebsite/docs: fix linux setup docs (cherry-pick #20508 to version-2025.12)
fixpolicies: fix PolicyEngineMode ALL with static binding optimization (cherry-pick #20430 to version-2025.12)
breakingwebsite/docs: remove bad logs redirect (cherry-pick #20522 to version-2025.12)
fixweb/sfe: bug: polyfill needed to supply Object.assign() to IE11. (cherry-pick #20126 to version-2025.12)
featurewebsite/docs: kerberos: add note about caching (cherry-pick #20663 to version-2025.12)
fixweb/admin: Fix SCIM page_size UI issue (cherry-pick #20890 to version-2025.12)
featureweb/flows: add continuous flow 2025.12
fixweb/admin: fix missing OSM referrerPolicy header (cherry-pick #20984 to version-2025.12)
fixweb/admin: handle non-string values in formatUUID to prevent Event Log crash (cherry-pick #20804 to version-2025.12)
fixsources/ldap: fix exception in ldap debug endpoint (cherry-pick #21219 to version-2025.12)
featurewebsite/docs: add example recovery flow with MFA (cherry-pick #19497 to version-2025.12)
fixroot: fix compose generation for patch releases release candidates (cherry-pick #21353 to version-2025.12)
fixproviders/saml: Fix redirect for saml slo (cherry-pick #21258 to version-2025.12)
featureproviders/oauth2: allow cross provider token introspection for federated providers (cherry-pick #21513 to version-2025.12)
fixproviders/radius: fix message authenticator validation (cherry-pick #21824 to version-2025.12)
fixweb: Fix duplicate Turnstile widgets after extended idle (cherry-pick #21380 to version-2025.12)
fixinternal: fix lint (cherry-pick #22263 to version-2025.12)
securityinternal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: CVE-2026-41577.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: CVE-2026-40172.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: CVE-2026-40166.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: CVE-2026-40165.sec.patch to authentik-2025.12
securityinternal: Automated internal backport: CVE-2026-42849.sec.patch to authentik-2025.12
+23 more items in the release notesfeaturewebsite/docs: Add changes in 2025.12.2 and 2025.12.3 to the release notes (cherry-pick #19949 to version-2025.12)
fixweb/admin: fix default binding order (cherry-pick #19943 to version-2025.12)
otherproviders/oauth2: use compare_digest for client_secret comparison (cherry-pick #19979 to version-2025.12)
otherrecovery: consume token in transaction (cherry-pick #19967 to version-2025.12)
othercore: bump django from 5.2.10 to 5.2.11 (cherry-pick #19988 to version-2025.12)
fixoutposts: fix docker_tls created files permission (cherry-pick #19978 to version-2025.12)
fixwebsite/docs: fix typos (cherry-pick #20000 to version-2025.12)
otherwebsite/docs: endpoint devices: more updates (cherry-pick #19971 to version-2025.12)
otherwebsite/docs: endpoint devices: specify name and slug (cherry-pick #20016 to version-2025.12)
fixwebsite/docs: endpoint devices: fix non debian wording (cherry-pick #20046 to version-2025.12)
otherdocs: add instructions for configuring rp-initiated single logout (cherry-pick #20040 to version-2025.12)
otherwebsite: QL Search keyboard interactions docs, examples. (cherry-pick #16259 to version-2025.12)
otherwebsite/docs: automated install: mention no file:// vars (cherry-pick #20043 to version-2025.12)
otheroutpost/proxyv2: revalidate auth if session fails to load (cherry-pick #18063 to version-2025.12)
otherwebsite/docs: capturing outpost logs (cherry-pick #20045 to version-2025.12)
otherwebsite/docs: endpoint devices: update device authentication location (cherry-pick #20049 to version-2025.12)
otherwebsite/docs: generate CVE sidebar (cherry-pick #20098 to version-2025.12)
fixsources/oauth: Fix InvalidAudienceError in id_token fallback (cherry-pick #20096 to version-2025.12)
featurewebsite/docs: add email verification scope doc (cherry-pick #20141 to version-2025.12)
fixwebsite/docs: rac: fixes the property mapping formatting (cherry-pick #20200 to version-2025.12)
otherwebsite/docs: ssf: update SSF documentation (cherry-pick #20195 to version-2025.12)
securitysecurity: CVE-2026-25922 (2025.12)
securitysecurity: CVE-2026-25748 (2025.12)
securitysecurity: CVE-2026-25227 (2025.12)
otherweb: updated package-lock.json to include missing tree-sitter references (cherry-pick #20244 to version-2025.12)
feature2025.12: Revert bulk revoke added by accident in release branch
fixweb/admin: fix toggle-group for bindings now showing up (cherry-pick #19820 to version-2025.12)
breakingwebsite/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.12)
fixweb: fix Brand CSS not applied to nested Shadow DOM components (cherry-pick #19892 to version-2025.12)
otherci: always generate API clients (#19906)
otherlifecycle/ak: make sure /data has the correct permissions (cherry-pick #19935 to version-2025.12)
featurelifecycle/aws: add /data volume (cherry-pick #19936 to version-2025.12)
otherwebsite/docs: Update location of media storage and outdated references (cherry-pick #19885 to version-2025.12)
fixcore: fix non-expiring service accounts and app passwords (cherry-pick #19913 to version-2025.12)
otherwebsite/docs: release notes: Update release notes for version 2025.12.1 (cherry-pick #19502 to version-2025.12)
featuresources/kerberos: update to new python-kadmin-rs (cherry-pick #19491 to version-2025.12)
featuretests/e2e: Add delay and serialized rollback to saml e2e test (cherry-pick #18840 to version-2025.12)
otherwebsite/docs: endpoint devices: update device code flow instructions (cherry-pick #19528 to version-2025.12)
fixadmin/files: fix manageable check blocking file creation on fresh installs (cherry-pick #19547 to version-2025.12)
fixadmin/files: fix duplicate bucket name in presigned URLs with custom domain (cherry-pick #19537 to version-2025.12)
securitycore: Update supported versions in SECURITY.md (cherry-pick #19385 to version-2025.12)
featurewebsite/docs: add s3 perms (cherry-pick #19579 to version-2025.12)
otherweb: update @goauthentik/api (cherry-pick #19542 to version-2025.12)
fixweb/forms: fix invalid date error for empty datetime-local inputs (cherry-pick #19561 to version-2025.12)
fixendpoints: fix endpoints stage marked as enterprise (cherry-pick #19607 to version-2025.12)
fixpolicies: fix Providers authentication_flow not used when set (cherry-pick #19609 to version-2025.12)
fixproviders/saml: fix structure of encrypted saml assertion (cherry-pick #19592 to version-2025.12)
featureproviders/saml: allow encryption certificates without private keys (cherry-pick #19526 to version-2025.12)
fixsources/saml: Fix signature verification order to accommodate encrypted assertions (cherry-pick #19593 to version-2025.12)
othertests: improve e2e/integration test reliability (cherry-pick #19540 to version-2025.12)
otherlib/sync/outgoing: handle deletions even if object does not exist in database (cherry-pick #18968 to version-2025.12)
otherwebsite/docs: endpoints devices: typo fix (cherry-pick #19621 to version-2025.12)
fixweb/user: fix Firefox for Android infinite render loop in user library (cherry-pick #19379 to version-2025.12)
fixweb/maintenance: fix missing custom web component imports (cherry-pick #18942 to version-2025.12)
otherwebsite/docs: Update saml google workspace guide (cherry-pick #19624 to version-2025.12)
otherwebsite/docs: update endpoint agent windows log location (cherry-pick #19645 to version-2025.12)
featureproviders/oauth2: add logout+jwt token type for oidc logout token. (cherry-pick #19554 to version-2025.12)
fixweb/forms: fix forms not resetting state when modal closes (cherry-pick #19562 to version-2025.12)
fixweb/admin: fix brand form sending "undefined" string for blank default application (cherry-pick #19658 to version-2025.12)
fixinternal: fix incorrect metric calculation (cherry-pick #19701 to version-2025.12)
featuresources/oauth: add fallback for id_token when profile URL is not available (cherry-pick #19311 to version-2025.12)
fixweb/admin: fix impersonation form requesting data without being opened (cherry-pick #19673 to version-2025.12)
featureweb/sfe: downgrade bootstrap, add access denied test (cherry-pick #19763 to version-2025.12)
fixwebsite/docs: fix Transifex link in translation guide (cherry-pick #19735 to version-2025.12)
fixwebsite/docs: endpoint devices: fix local device login (cherry-pick #19698 to version-2025.12)
fixwebsite/docs: Fix authenticator sms docs (cherry-pick #19797 to version-2025.12)
fixproviders/scim: fix email validation mismatch (cherry-pick #19848 to version-2025.12)
fixsources/oauth: Fix an issue where wechat may crash duing login. (cherry-pick #18973 to version-2025.12)
featurewebsite/docs: add more info to entra id scim doc (cherry-pick #19849 to version-2025.12)
featurewebsite/docs: add tip for recovering from accidental main branch work (cherry-pick #19865 to version-2025.12)
featureadmin/files: add centralized theme variable support for file URLs (cherry-pick #19657 to version-2025.12)
fixweb/admin: fix file upload not preserving extension for custom names with dots (cherry-pick #19548 to version-2025.12)
fixweb/admin: fix captcha stage provider selector not showing saved value (cherry-pick #19555 to version-2025.12)
featurewebsite/docs: endpoint devices: add version command (cherry-pick #19767 to version-2025.12)
+14 more items in the release notesbreakingwebsite/docs: remove "beta" tag from 2025.12 (cherry-pick #19404 to version-2025.12)
fixoutposts/ldap: fix build
featurewebsite/docs: add import to discord policy (cherry-pick #19397 to version-2025.12)
otherwebsite/docs: mention dynamic overrides in redirect stage documentation (cherry-pick #19368 to version-2025.12)
otherwebsite/docs: update gws provider docs (cherry-pick #18286 to version-2025.12)
deprecatedweb/startup: deprecated theme names break theming (cherry-pick #19431 to version-2025.12)
otherci: fix checkout stable (for 2025.12) (#19448)
featureproviders/oauth2: allow property mappings to override scope claim in access tokens (cherry-pick #19226 to version-2025.12)
othercore: bump aiohttp from 3.13.2 to v3.13.3 (cherry-pick #19257 to version-2025.12)
otherendpoints/connectors/agent: Skip Endpoint stage on device IA & fix confusing identification subtext (cherry-pick #19482 to version-2025.12)
otherwebsite/docs: limiting permissions of AD service account (cherry-pick #19483 to version-2025.12)
featureendpoints/connectors/agent: add tests for IA endpoint stage (cherry-pick #19487 to version-2025.12)
otherweb: Z-Index Fixes, Mobile Sidebar Behavior. (cherry-pick #19460 to version-2025.12)
fixweb/admin: fix switches (cherry-pick #19493 to version-2025.12)
otherendpoints: include license status in agent config (cherry-pick #19227 to version-2025.12)
otherwebsite/docs: revisit endpoint docs the nth (cherry-pick #19116 to version-2025.12)
otherwebsite/glossary: improve (cherry-pick #18969 to version-2025.12)
fixcore: fix read replica routing during transactions (cherry-pick #19086 to version-2025.12)
otherstages/authenticator_static: set max token length to 100 chars (cherry-pick #19162 to version-2025.12)
fixwebsite: Fix typos. (cherry-pick #19243 to version-2025.12)
otherstages/prompt: optimize API endpoints (cherry-pick #19251 to version-2025.12)
otherstages/password: replace session-based retries with reputation (cherry-pick #18643 to version-2025.12)
featureweb/admin: add banner to flow import form (cherry-pick #19288 to version-2025.12)
othercore: bump urllib3 from 2.5.0 to v2.6.3 (cherry-pick #19287 to version-2025.12)
othercore: bump django from v5.2.9 to 5.2.10 (cherry-pick #19290 to version-2025.12)
otherwebsite/docs: update entra id provider docs (cherry-pick #18366 to version-2025.12)
deprecatedwebsite/docs: deprecate GCDT auth stage (cherry-pick #19306 to version-2025.12)
otherwebsite/docs: update m2m doc (cherry-pick #18963 to version-2025.12)
fixwebsite/docs: Fix documentation example for app_entitlements_attributes. (cherry-pick #19316 to version-2025.12)
featurewebsite/docs: add flow import warnings (cherry-pick #19307 to version-2025.12)
fixwebsite/docs: Fix typo in GitHub OAuth Source instructions (cherry-pick #18936 to version-2025.12)
fixweb: Fix flow inspector advancement event. (cherry-pick #19309 to version-2025.12)
otherwebsite/docs: update github social login script example (cherry-pick #19246 to version-2025.12)
otherwebsite/docs: update unique email policy (cherry-pick #19305 to version-2025.12)
otherweb: Images styles, theming (cherry-pick #19233 to version-2025.12)
otherwebsite/docs: update LDAP provider docs (cherry-pick #18272 to version-2025.12)
otherpackages/django-dramatiq-postgres: broker: empty message after task completed successfully (cherry-pick #19340 to version-2025.12)
otherweb/admin: always retrieve selected provider when editing the application (cherry-pick #19341 to version-2025.12)
otherweb/elements: hidden secrets not propagating (cherry-pick #19029 to version-2025.12)
fixoutpost/proxyv2: fix stale session cookie causing 400 error in createState (cherry-pick #19026 to version-2025.12)
otherwebsite/docs: update location for logs on windows (cherry-pick #19371 to version-2025.12)
otherinternal/outpost: improve PostgreSQL connection options parsing (cherry-pick #19118 to version-2025.12)
otherweb: Flow info, localization, back button. (cherry-pick #19234 to version-2025.12)
otherstages/authenticator_validate: decrease reputation on failed MFA attempt (cherry-pick #19378 to version-2025.12)
otherinternal: rework liveness probe and proxy (cherry-pick #19312 to version-2025.12)
otherweb: UI Locale Fixes (cherry-pick #19235 to version-2025.12)
fixweb/flow: Fix spurious double submit on ak-stage-autosubmit (cherry-pick #18727 to version-2025.10)
featurewebsite/docs: add note to active directory source doc (cherry-pick #18787 to version-2025.10)
otherwebsite/docs: Backport version picker updates. (cherry-pick #18964 to version-2025.10)
fixweb/admin: fix dark theme on map (cherry-pick #18985 to version-2025.10)
fixweb/admin: Fix haveibeenpwned link in PasswordPolicyForm (cherry-pick #18984 to version-2025.10)
othercore: use chunked_queryset for expired message deletion (cherry-pick #19028 to version-2025.10)
otherinternal: update TLS Suite (cherry-pick #19076 to version-2025.10)
fixwebsite/docs: fix build (cherry-pick #19148 to version-2025.10)
fixweb: fix slug auto-updating when editing existing applications (cherry-pick #19169 to version-2025.10)
fixcore: fix read replica routing during transactions (cherry-pick #19086 to version-2025.10)
featureweb/admin: add banner to flow import form (cherry-pick #19288 to version-2025.10)
otherwebsite/docs: update entra id provider docs (cherry-pick #18366 to version-2025.10)
fixwebsite/docs: Fix typo in GitHub OAuth Source instructions (cherry-pick #18936 to version-2025.10)
fixwebsite/docs: Fix documentation example for app_entitlements_attributes. (cherry-pick #19316 to version-2025.10)
otherwebsite/docs: update m2m doc (cherry-pick #18963 to version-2025.10)
otherwebsite/docs: update LDAP provider docs (cherry-pick #18272 to version-2025.10)
otherweb/elements: hidden secrets not propagating (cherry-pick #19029 to version-2025.10)
fixoutpost/proxyv2: fix stale session cookie causing 400 error in createState (cherry-pick #19026 to version-2025.10)
otherinternal: rework liveness probe and proxy (cherry-pick #19312 to version-2025.10)
otherwebsite/docs: update gws provider docs (cherry-pick #18286 to version-2025.10)
featurewebsite/docs: add import to discord policy (cherry-pick #19397 to version-2025.10)
otherwebsite/docs: mention dynamic overrides in redirect stage documentation (cherry-pick #19368 to version-2025.10)
otherwebsite/docs: limiting permissions of AD service account (cherry-pick #19483 to version-2025.10)
featureproviders/oauth2: add logout+jwt token type for oidc logout token. (cherry-pick #19554 to version-2025.10)
fixinternal: fix incorrect metric calculation (cherry-pick #19701 to version-2025.10)
othercore: return bad request when user is authenticated and not active (cherry-pick #19706 to version-2025.10)
fixweb/admin: fix impersonation form requesting data without being opened (cherry-pick #19673 to version-2025.10)
featureweb/sfe: downgrade bootstrap, add access denied test (cherry-pick #19763 to version-2025.10)
fixwebsite/docs: fix Transifex link in translation guide (cherry-pick #19735 to version-2025.10)
otherroot: update client-go generation (cherry-pick #19762 and #19906 to version-2025.10)
otherrecovery: consume token in transaction (cherry-pick #19967 to version-2025.10)
otherproviders/oauth2: use compare_digest for client_secret comparison (cherry-pick #19979 to version-2025.10)
breakingwebsite/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.10)
otherdocs: add instructions for configuring rp-initiated single logout (cherry-pick #20040 to version-2025.10)
othercore: bump django from v5.2.8 to 5.2.11 (version-2025.10)
featurewebsite/docs: add email verification scope doc (cherry-pick #20141 to version-2025.10)
fixwebsite/docs: rac: fixes the property mapping formatting (cherry-pick #20200 to version-2025.10)
securitysecurity: CVE-2026-25922 (2025.10)
securitysecurity: CVE-2026-25748 (2025.10)
securitysecurity: CVE-2026-25227 (2025.10)
+4 more items in the release notesfixwebsite/docs: fix broken link in source switching doc (cherry-pick #18317 to version-2025.10)
otherwebsite/docs: further improvments to source switch doc (cherry-pick #18320 to version-2025.10)
otherwebsite/docs: enhance blueprint docs (cherry-pick #15984 to version-2025.10)
featurewebsite/docs: added missed edits on Blueprints docs (cherry-pick #18321 to version-2025.10)
featurewebsite/docs: add high availability doc (cherry-pick #18182 to version-2025.10)
otherwebsite/docs: update info about docker socket mount (cherry-pick #18344 to version-2025.10)
otheroutposts: set container healthcheck inline (cherry-pick #18298 to version-2025.10)
featureweb/admin: add entitlement search (cherry-pick #18291 to version-2025.10)
otherlib/sync/outgoing: check if there is a provider before creating tasks (cherry-pick #18394 to version-2025.10)
fixweb/admin: fix wording in password stage (cherry-pick #18393 to version-2025.10)
fixweb: Fix stale table rows (cherry-pick #17940 to version-2025.10)
otherweb: revert Fix stale table rows (cherry-pick #17940 to version-2025.10)
otherstages/prompt: set allow_blank for _read_only fields (cherry-pick #18297 to version-2025.10)
fixpackages/django-channels-postgres: fix notify size check (cherry-pick #18347 to version-2025.10)
otherwebsite/docs: improve creds recovery docs (cherry-pick #18385 to version-2025.10)
fixweb/admin: fixes capitalization in application wizard title (cherry-pick #17959 to version-2025.10)
otherwebsite/docs: update certificate doc (cherry-pick #18295 to version-2025.10)
otherproviders/scim: compare users/groups before sending update request (cherry-pick #18456 to version-2025.10)
fixweb/admin: fix brands default switch label (cherry-pick #18518 to version-2025.10)
fixwebsite/docs: expressions: fix markdown (cherry-pick #18613 to version-2025.10)
featurewebsite/docs: adds note about ak_create_jwt function (cherry-pick #18614 to version-2025.10)
otherflows: refresh unauthenticated tabs (cherry-pick #18621 to version-2025.10)
fixroot: fix missing authentik_device cookie causing error (cherry-pick #18642 to version-2025.10)
fixenterprise/stages/mtls: fix traefik certificate parsing (cherry-pick #18607 to version-2025.10)
fixweb: Fix row expansion on modal trigger buttons. (cherry-pick #18412 to version-2025.10)
fixweb/admin: fix event volume chart not updating with query (cherry-pick #18649 to version-2025.10)
othersources/ldap: make server info optional (cherry-pick #18648 to version-2025.10)
fixwebsite/docs: install-config: fix dump_config command (cherry-pick #18659 to version-2025.10)
otherroot: skip current tab when refreshing others (cherry-pick #18674 to version-2025.10)
otherweb: Hide device picker when challenges are not present. (cherry-pick #18611 to version-2025.10)
otherweb: Improved table selection behavior (cherry-pick #18622 to version-2025.10)
featurewebsite/docs: background tasks: add more detail about "next run" (cherry-pick #18660 to version-2025.10)
otheroutpost/proxyv2: more tests, fix pg password with spaces, and existing session on restart (cherry-pick #18211 to version-2025.10)
othercore: optimize list applications (cherry-pick #18330 to version-2025.10)
othercore: list applications fix (cherry-pick #18798 to version-2025.10)
otherpackages/django-dramatiq-postgres: broker: close django connections on consumer close (cherry-pick #18833 to version-2025.10)
featurewebsite/docs: add icon info to style guide (cherry-pick #18832 to version-2025.10)
otherwebsite/docs: 2025.10.3 release notes (cherry-pick #18868 to version-2025.10)
featurebrands: add more matching tests (cherry-pick #16185 to version-2025.10)
otherbrands: sort matched brand by match length (cherry-pick #17920 to version-2025.10)
fixtasks/schedules: fix rel obj not being associated or updated (cherry-pick #17934 to version-2025.10)
featurewebsite/docs: added Note about email_verified scope mapping is set to false by default (cherry-pick #17942 to version-2025.10)
breakingwebsite/docs: remove broken info box and fix sentence (cherry-pick #17963 to version-2025.10)
othercore: bump django from 5.2.7 to 5.2.8 (cherry-pick #17967 to version-2025.10)
otherwebsite/docs: updates img-src csp (cherry-pick #18010 to version-2025.10)
otherci: fix migrate-from-stable for old versions (#18019)
fixwebsite/release notes: fix broken urls (cherry-pick #18041 to version-2025.10)
otherwebsite/docs: update discord social login script example (cherry-pick #18026 to version-2025.10)
otherci: attempt to fix integration tests using dind (cherry-pick #18066 to version-2025.10)
otherci: revert to upstream GHA for release (#18058)
fixevents: fix timezone not set for log events (cherry-pick #18067 to version-2025.10)
featureproviders/scim: allow custom schema data (cherry-pick #18073 to version-2025.10)
othercore: improve app launch URL formatting (cherry-pick #18076 to version-2025.10)
breakingcmd/server/healthcheck: remove worker HTTP healthcheck (cherry-pick #18090 to version-2025.10)
fixweb: Fix RAC modal visibility. (cherry-pick #17941 to version-2025.10)
fixweb: Fix tab activation, blank provider URLs (cherry-pick #18031 to version-2025.10)
fixwebsite/docs: fix wording in stages overview (cherry-pick #18061 to version-2025.10)
otherpackages/django-dramatiq-postgres: broker: ensure locking happens with the same connection (cherry-pick #18095 to version-2025.10)
otherweb/flows: improvements for hCaptcha (cherry-pick #16882 to version-2025.10)
otherweb/admin: link to user on invitation list page (cherry-pick #18132 to version-2025.10)
fixpackages/django-channels-postgres/layer: fix query when subscribed to multiple channels (cherry-pick #18152 to version-2025.10)
otherweb: Disable library on Firefox. (cherry-pick #18103 to version-2025.10)
otherweb/sfe: downgrade bootstrap that was accidentally upgraded (cherry-pick #18157 to version-2025.10)
featurewebsite/docs: Add instructions for installing RC versions (cherry-pick #18099 to version-2025.10)
otherwebsite/docs: update application description (cherry-pick #18125 to version-2025.10)
fixstages/prompt: fix choices with labels causing error on submit (cherry-pick #18183 to version-2025.10)
otherinternal: Automated internal backport: 1487-invitation-expiry.sec.patch to authentik-2025.10
otherinternal: Automated internal backport: 1498-oauth2-cc-user-active.sec.patch to authentik-2025.10
otherinternal: Automated internal backport: 5000-sidebar.sec.patch to authentik-2025.10
featurewebsite/docs: add 2025.8.5 and 2025.10.2 release notes (cherry-pick #18268 to version-2025.10)
fixwebsite/docs: fix placeholder leftover (cherry-pick #17737 to version-2025.10)
featureroot: Add Dockerfile label org.opencontainers.image.source (cherry-pick #17756 to version-2025.10)
fixproviders/proxy: fix missing JWT/claims header (cherry-pick #17759 to version-2025.10)
othersources/oauth: Make PKCE verifier 128 characters (cherry-pick #17763 to version-2025.10)
fixproviders/radius: fix panic when no cert is configured (cherry-pick #17762 to version-2025.10)
otherproviders/oauth2: move encryption key field (cherry-pick #17722 to version-2025.10)
otherpackages/django-postgres-cache: use upsert instead of select/update in a transaction (cherry-pick #17760 to version-2025.10)
othertasks: delay startup signals (cherry-pick #17769 to version-2025.10)
otherroot: use hashes for dockerfile FROM (cherry-pick #17795 to version-2025.10)
deprecatedinternal: fix go deprecation for +build (cherry-pick #17806 to version-2025.10)
otherci: rework internal repo (#17797)
fixinternal/web/proxy: fix return status code during startup (cherry-pick #17827 to version-2025.10)
fixweb/admin: fix scim provider form (cherry-pick #17831 to version-2025.10)
othercore: bump astral-sh/uv from 0.9.5 to 0.9.6 (cherry-pick #17820 to version-2025.10)
othertasks: sanitize log attributes (cherry-pick #17833 to version-2025.10)
otheroutposts: update permissions more eagerly (cherry-pick #17783 to version-2025.10)
breakingoutpost: revert breaking signals change (cherry-pick #17847 to version-2025.10)
otherinternal: full openssl path (cherry-pick #17856 to version-2025.10)
otherweb: Consistent Tab Panel URL Parameters (cherry-pick #17804 to version-2025.10)
fixweb/a11y: User library -- fix issues surrounding element focus, ARIA labeling. (cherry-pick #17522 to version-2025.10)
fixproviders/radius: fix inverted message authenticator validation (cherry-pick #17855 to version-2025.10)
otherproviders/radius: revert fix inverted message authenticator validation (#17855) (cherry-pick #17915 to version-2025.10)
fixproviders/oauth2: fix kid always required for federation (cherry-pick #17914 to version-2025.10)
otherwebsite/docs: 2025.10.1 release notes (cherry-pick #17918 to version-2025.10)
featureenterprise: add prometheus metrics for license usage and expiry (cherry-pick #17606 to version-2025.10)
featurewebsite/docs: rel notes 2025.10: add 3 more integration guides (cherry-pick #17641 to version-2025.10)
otherproviders/proxy: drop headers with underscores (cherry-pick #17650 to version-2025.10)
featurewebsite/docs: add note about invite link not bound (cherry-pick #17657 to version-2025.10)
featurewebsite/docs: eap add info about custom validation (cherry-pick #17642 to version-2025.10)
featurewebsite/docs: release notes: Add Zot integration (cherry-pick #17700 to version-2025.10)
featurewebsite/docs: add short-lived certificate recommendation (cherry-pick #17628 to version-2025.10)
featurewebsite/docs: blueprints: add a bit more info (cherry-pick #17704 to version-2025.10)
otherenterprise: handle cached naive timezone (cherry-pick #17695 to version-2025.10)
otherwebsite/docs: update flow context ref (cherry-pick #17723 to version-2025.10)
otherwebsite/docs: finalise 2025.10 release notes (cherry-pick #17728 to version-2025.10)
breakingwebsite/docs: Remove stale 2024 version directives (cherry-pick #19888 to version-2025.8)
otherroot: update client-go generation (cherry-pick #19762 and #19906 to version-2025.8)
otherwebsite/docs: generate CVE sidebar (cherry-pick #20098 to version-2025.8)
securitysecurity: CVE-2026-25922 (2025.8)
securitysecurity: CVE-2026-25748 (2025.8)
securitysecurity: CVE-2026-25227 (2025.8)
otherwebsite/docs: developer docs: adjust sentence for writing docs (cherry-pick #17137 to version-2025.8)
otherbuild(deps): bump django from 5.1.12 to 5.1.13 (cherry-pick #17198 to version-2025.8)
fixpackages/django-dramatiq-postgres: broker: fix task expiration (cherry-pick #17178 to version-2025.8)
fixpackages/django-dramatiq-postgres: fix error when updating task with no changes (cherry-pick #16728 to version-2025.8)
othertasks/middlewares/messages: make sure exceptions are always logged (cherry-pick #17237 to version-2025.8)
fixcore: fix absolute and relative path file uploads (cherry-pick #17269 to version-2025.8)
fixweb: Fix behavior for modals configured with closeAfterSuccessfulSubmit (cherry-pick #17277 to version-2025.8)
otherlib/sync/outgoing: revert reduce number of db queries made (revert #14177) (cherry-pick #17306 to version-2025.8)
otherblueprints: ensure tasks retry on database errors (cherry-pick #17333 to version-2025.8)
fixweb/admin: fix incorrect placeholder for scim provider (cherry-pick #17308 to version-2025.8)
featurewebsite/docs: add entra id scim source (cherry-pick #17357 to version-2025.8)
featurewebsite/docs: add email config section (cherry-pick #16727 to version-2025.8)
featurewebsite: add powershell syntax highlighting and bump package (cherry-pick #16683)
otherwebsite/docs: update SAML provider docs (cherry-pick #15887 to version-2025.8)
otherci: rework internal repo (#17797)
otherci: fix migrate-from-stable for old versions
othercore: bump Django from 5.1.13 to 5.1.14 for 2025.8
otherinternal: Automated internal backport: 1498-oauth2-cc-user-active.sec.patch to authentik-2025.8
otherinternal: Automated internal backport: 1487-invitation-expiry.sec.patch to authentik-2025.8
otherinternal: Automated internal backport: 5000-sidebar.sec.patch to authentik-2025.8
featurewebsite/docs: add 2025.8.5 and 2025.10.2 release notes (cherry-pick #18268 to version-2025.8)
otherwebiste/docs: improve user ref doc (cherry-pick #16779)
fixproviders/scim: fix string formatting for SCIM user filter (cherry-pick #16465)
fixwebsite/docs: 2025.8: fix worker concurrency setting rename (cherry-pick #16946)
fixwebsite/docs: fix capitalization (cherry-pick #16944)
otherwebsite/docs: random typo fixes (cherry-pick #16956)
featurewebsite/docs: add docs for source switch expression policy (cherry-pick #16878)
otherwebsite/docs: update url to docker-compose.yml (cherry-pick #16901)
otherwebsite/developer docs: What domain for what doc version (cherry-pick #16987)
featureproviders/ldap: add include_children parameter to cached search mode (cherry-pick #16918)
featurewebsite/docs: oauth provider: Add device and introspect to reserved slugs (cherry-pick #16994)
featurewebiste/docs: add missing oauth endpoints (cherry-pick #16995)
otherwebsite/docs: improve discord policies when also bound to non-oauth sources (cherry-pick #17008)
fixrbac: fix typo (cherry-pick #16476)
featurecore: add index on Group.is_superuser (cherry-pick #17011)
otherlib: match exception_to_dict locals behaviour (cherry-pick #17006)
otherwebsite/docs: Update Github expression to handle non-OAuth sources gracefully (cherry-pick #17014)
fixlib/config: fix listen settings (cherry-pick #17005)
other*/bindings: order by pk (cherry-pick #17027)
fixtasks: fix logger name (cherry-pick #17009 to version-2025.8)
fixweb/admin: fix federation sources automatically selected (cherry-pick #17069 to version-2025.8)
otherrbac: optimize rbac assigned by users query (cherry-pick #17015 to version-2025.8)
fixweb: Fix layout class for row in LibraryPage (cherry-pick #16752 to version-2025.8)
othercmd/server/healthcheck: info log success instead of debug (cherry-pick #17093 to version-2025.8)
featureoutposts/ldap: add pwdChangeTime attribute (cherry-pick #17010 to version-2025.8)
fixstages/identification: fix mismatched error messages (cherry-pick #17090 to version-2025.8)
fixproviders/oauth2: fix authentication error with identical app passwords (cherry-pick #17100 to version-2025.8)
fixpackages/django-dramatiq-postgres: broker: fix new messages not being picked up when too many messages are waiting (cherry-pick #17106 to version-2025.8)
othertasks: reduce default number of retries and max backoff (cherry-pick #17107 to version-2025.8)
otherwebsite/docs: 2025.8.4 release notes (cherry-pick #17119 to version-2025.8)
fixwebsite/docs: fix docker tabs not rendering properly (cherry-pick #16799)
fixlifecycle: fix permission error when running worker as root (cherry-pick #16735)
otherwebsite/docs: update create oauth provider page (cherry-pick #16617)
fixstages/email_authenticator: Fix email mfa loop (cherry-pick #16579)
otherwebsite/docs: 2025.8.3 release notes (cherry-pick #16809)
otherwebsite/docs: 2025.8.1 release notes (cherry-pick #16343)
otherproviders/oauth2: avoid deadlock during session migration (cherry-pick #16361)
otherwebsite: cherry-pick 2025.8/client side redirects
securityroot: update security.md with github reporting link (cherry-pick #16332)
fixlifecycle: fix PROMETHEUS_MULTIPROC_DIR missing suffix (cherry-pick #16401)
fixtasks/schedules: fix api search fields (cherry-pick #16405)
featurewebsite/docs: adds details to certificates doc (cherry-pick #16335)
securityroot: fix security.md (cherry-pick #16345)
fixproviders/rac: fix AuthenticatedSession migration (cherry-pick #16400)
otherwebsite/docs: update internal vs external user information (cherry-pick #16359)
fixlib/sync: fix missing f for string (cherry-pick #16423)
otherwebsite/docs: capitalized proper name of stages, removed old version references. (cherry-pick #16414)
othercore: bump h2 from 4.2.0 to 4.3.0 (cherry-pick #16446)
fixlib/sync/outgoing: fix single object sync timeout (cherry-pick #16447)
fixcore: fix client-side only validation allowing admin to set blank user password (cherry-pick #16467)
otherwebsite: Unify Netlify redirects with Docusaurus's client-side router. (backport of #16430)
otherwebsite: Page redirect guide, documentation (backport of #16466)
breakingpolicies: remove object pk from authentik_policies_execution_time to reduce cardinality (cherry-pick #16500)
fixwebsite/integrations: bitwarden: fix ent notice (cherry-pick #16502)
otherwebsite/docs: update how to rac and outpost landing page (cherry-pick #16442)
otherwebsite/docs: improve customize your instance page layout (cherry-pick #16367)
otherwebsite/docs: update external user information (cherry-pick #16493)
otherwebsite/docs: changes all -> arrows to > (cherry-pick #16569)
breakingwebsite/docs: remove base providers redirect. (cherry-pick #16576)
featurewebsite: Add text copy of license (cherry-pick #16559)
otherroot: clean up README (cherry-pick #16286)
fixsources/ldap: fix malformed filter error with special characters in group DN (cherry-pick #16243)
othercore: bump django from 5.1.11 to v5.1.12 (cherry-pick #16584)
otherwebsite: Update license text to use "directory" (cherry-pick #16589)
otherweb/flows: only disable login button when interactive captcha is configured and not loaded (cherry-pick #16586)
featureproviders/oauth2: add missing exp claim for logout token (cherry-pick #16593)
otherproviders/scim: improve error message when object fails to sync (cherry-pick #16625)
breakingtasks: fix status and healthcheck breaking with connection issues (cherry-pick #16504)
fixwebsite/docs: fix typo (cherry-pick #16681)
featurewebsite/docs: add rate limiting info to Email stage docs (cherry-pick #16668)
featurewebsite: Redirect Azure to Entra. Add tags for search indexing. (cherry-pick #16474)
featurewebsite/docs: add missing notification rule example doc to sidebar (cherry-pick #16478)
otherwebsite/docs: clarify docker compose install (cherry-pick #16696)
otherwebsite/docs: moves display source notes (cherry-pick #16704)
fixwebsite/docs: fix typos (cherry-pick #16716)
+7 more items in the release notesfix*: Fix dead doc link (cherry-pick #16288)
fixweb: fix "Explore integrations" link in Quick actions (cherry-pick #16274)
fixweb: Fix hidden textarea required attribute. (cherry-pick #16168)
fixproviders/oauth2: fix logout token missing sid, fix wrong sub mode used (cherry-pick #16295)
otherlifecycle: set PROMETHEUS_MULTIPROC_DIR as early as possible (cherry-pick #16298)
fixweb: Fix issue where clicking a list item scrolls container (cherry-pick #16174)
otherweb: Improvements to ReCaptcha resizing (cherry-pick #16171)
fixweb: Fix form group slots (cherry-pick #16276)
otherweb: Username truncation, field alignment. (cherry-pick #16283)
featurewebsite/docs: add link in 2025.8 rel notes to back-channel logout doc (cherry pick #16306)
othercore: use email backend for test_email management command (cherry-pick #16311)
fixpackages/django-dramatiq-postgres: middleware: fix listening on hosts where ipv6 is not supported (cherry-pick #16308)
fixoutposts: fix service connection update task arguments (cherry-pick #16312)
featureoutposts: allow ingress path type configuration (cherry-pick #16339)
otherwebsite: Hotfix version 2025.8/website versioning
fixpackages/django-dramatiq-postgres: broker: fix various timing issues (cherry-pick #16340)
featurewebsite/docs: update Advanced Queries docs and Rel Notes with new Int Guide (cherry-pick #16191)
otherwebsite/docs: sys-mgmt/s3: Clean up and improve (cherry-pick #16242)
securitysecurity: Bump supported versions (cherry-pick #16261)
otherwebsite/docs: update 2025.8 release notes (cherry-pick #16269)
featuretasks: add rel_obj to system task exception event (cherry-pick #16270)
securityFixes CVE-2025-53942: Insufficient check for account active status when authenticating with OAuth/SAML Sources
fixweb/elements: fix table search not resetting page when query changes (cherry-pick #15324)
featurewebsite/docs: re-add gtag (cherry-pick #15334)
fixcore: fix missing serializer on AuthenticatedSession (cherry-pick #15323)
otherwebsite: Mark all URLs as external. (cherry-pick #15363)
fixcore: fix set_token_key permission not declared (cherry-pick #15384)
featurewebsite/docs: add manual RAC outpost deployment information (cherry-pick #15362)
otherwebsite/docs: improve the docs about our Events and logging (cherry-pick #15270)
otherwebsite/docs: Cherry pick events docs (cherry-pick #15457)
otherwebsite/docs: postgres troubleshooting: get PGPASSWORD from POSTGRES_PASSWORD_FILE (cherry-pick #15039)
fixwebsite/docs: troubleshooting: Fix variable for postgres database in k8s (cherry-pick #15503)
fixproviders/proxy: fix ingress-nginx proxy buffer size annotations (cherry-pick #15506)
featurewebsite/docs: add noun for SSO (cherry-pick #15509)
featurewebsite/docs: Add FIDO2 references to the documentation (cherry-pick #14826)
featurewebsite/docs: add use case, move diagram, link to ABM (cherry-pick #15491)
fixwebsite/docs: fix a typo in SSF docs (cherry-pick #15554)
featurewebsite/docs: added enterprise label to new Logging docs (cherry-pick #15556)
fixwebsite/docs: fix user ref typos (cherry-pick #15653)
otherproviders/radius: set message authenticator (cherry-pick #15635)
featurewebsite/docs: add more to style guide (cherry-pick #14797)
otherci: fix post-release e2e builds failing (cherry-pick #15082)
featureweb/elements: Add light mode custom css handling (cherry-pick #14944)
othercore: bump tornado from 6.4.2 to v6.5.1 (cherry-pick #15100)
othercore: bump requests from 2.32.3 to v2.32.4 (cherry-pick #15129)
fixsources/ldap: fix sync on empty groups (cherry-pick #15158)
othercore: bump urllib3 from 2.4.0 to v2.5.0 (cherry-pick #15131)
othercore: bump protobuf from 6.30.2 to v6.31.1 (cherry-pick #14894)
fixwebsite/docs: fixes misplaced sentence (cherry-pick #14998)
fixwebsite/docs: fix egregious maintenance fail (cherry-pick #15176)
fixweb/user: fix infinite loop when no user settings flow is set (cherry-pick #15188)
otherci: fix CodeQL failing on cherry-pick PRs (cherry-pick #15205)
featurewebsite/docs: add credentials prompt for rac doc (cherry-pick #14840)
fixwebsite/docs: fix note at end of rac credentials prompt (cherry-pick #14909)
featurewebsite/docs: Add steps to troubleshoot /initial-setup/ (cherry-pick #15011)
otherweb/elements: typing error when variables are not converted to string (cherry-pick #15169)
othercore: bump goauthentik/fips-python from 3.13.3-slim-bookworm-fips to 3.13.5-slim-bookworm-fips in 2025.6
securitysecurity: fix CVE-2025-52553 (cherry-pick #15289)
featurewebsite/docs: add 2025.6.1 release notes (cherry-pick #14948)
otherstages/email: Only attach logo to email if used (cherry-pick #14835)
fixweb/elements: fix dual select without sortBy (cherry-pick #14977)
fixinternal/outpost: fix incorrect usage of golang SHA API (cherry-pick #14981)
fixbrands: fix custom_css being escaped (cherry-pick #14994)
othercore: bump django from 5.1.9 to 5.1.10 (cherry-pick #14951)
othercore: bump django from 5.1.10 to 5.1.11 (cherry-pick #14997)
otherwebsite/docs: also hide the postgres pool_options setting (cherry-pick #15023)
fixproviders/rac: fixes prompt data not being merged with connection_settings (cherry-pick #15037)
fixweb/elements: fix typo in localeComparator (cherry-pick #15054)
otherwebsite/docs: correct minor version in release notes (cherry-pick #15012)
breakingwebsite/docs: remove commented out config options (cherry-pick #15064)
fixcore: fix transaction test case (cherry-pick #15021)
otherwebsite/docs: release notes for 2025.6.2 (cherry-pick #15065)
featurewebsite/releases: order new integrations alphabetically (cherry-pick #14850)
featurewebsite/release notes: add tailscale to new integrations (cherry-pick #14859)
otherwebsite/integrations: tailscale (cherry-pick #14499)
otherwebsite/docs: rotate supported versions: 2025.6 (cherry-pick #14856)
fixweb/user: fix user settings flow not loading (cherry-pick #14911)
featureproviders/proxy: add option to override host header with property mappings (cherry-pick #14927)
fixlifecycle: fix test-all in docker
featurewebsite/integrations: adds missing trailing slash in homarr doc
fixweb: fix bug that was causing charts to be too tall
featurewebsite/docs: add device code flow instructions
featurerbac: add name to Permissions search
featurewebsite/docs: add postgres pool configuration
featurewebsite/docs: add LDAP 'Lookup using user attribute' docs
featurewebsite/docs: add gateway API to release notes and documentation
fixwebsite/docs: initial permissions: fix usage of term admin
breakingwebsite/docs: clarify 2025.4 breaking Reputation changes
fixbrands: fix CSS Migration not updating brands
featurewebsite/docs: adds webfinger doc under oauth provider
fixrbac: fix RoleObjectPermissionTable not showing add_user_to_group
fixwebsite/docs: fix dry-run release highlight
breakingwebsite/docs: remove support badge
fixweb: Clean up browser-only module imports that crash WebDriverIO.
featurewebsite/integrations: add atlassian
featurewebsite/docs: Add pkg-config to the brew dependencies
featurewebsite/docs: add one more reference and link about can view Admin interface
featuretests/e2e: Add E2E tests for Flow SFE
breakingcore: remove OldAuthenticatedSession content type
featuretests/e2e: add test for authentication flow in compatibility mode
featureenterprise/stages: Add MTLS stage
securitywebsite/integrations: add push security
deprecatedwebsite/integrations: minio: notice about sso deprecation on CE
featurewebsite/docs: add login page source note to all source docs
featureweb: Add specific Storybook dependency.
featuresources/ldap: add forward deletion option
featurewebsite/integrations: add stripe
featurewebsite/integrations: add filerise
featurewebsite/integrations: add pangolin
featurewebsite/docs: add docs for MTLS Stage
featuresources/ldap: add user_membership_attribute
breakingstages/user_login: remove success message
breakingwebsite/docs: configuration: remove deprecated key for session storage location
featurewebsite/integrations: add komodo
featureproviders/scim: allow for specifying custom SCIM schemas for users and groups
breakingwebsite/docs: remove fluff from release notes 2025.6 (cherry-pick #14819)
breakingwebsite/integrations: remove trailing slash from budibase redirect (cherry-pick #14823)
featurewebsite/docs: add LDAP docs for forward deletion and memberUid (cherry-pick #14814)
+281 more items in the release notessecurityFixes CVE-2025-53942: Insufficient check for account active status when authenticating with OAuth/SAML Sources
featurewebsite/docs: add manual RAC outpost deployment information (cherry-pick #15362)
securityFixes CVE-2025-52553: Insufficient Session verification for Remote Access Control endpoint access
otherwebsite/docs: also hide the postgres pool_options setting (cherry-pick #15023)
breakingwebsite/docs: remove commented out config options (cherry-pick #15064)
fixwebsite/docs: fix egregious maintenance fail (cherry-pick #15176)
fixwebsite/docs: fixes misplaced sentence (cherry-pick #14998)
fixlifecycle: fix arguments not being passed to worker command (cherry-pick #14574)
fixsources/scim: fix all users being added to group when no members are given (cherry-pick #14645)
otherci: fix broken cache (cherry-pick #14725)
othercore: Migrate permissions before deleteing OldAuthenticatedSession (cherry-pick #14788)
breakingwebsite/docs: clarify 2025.4 breaking Reputation changes (cherry-pick #14284)
fixwebsite/docs: fix dry-run release highlight (cherry-pick #14337)
fixwebsite/docs: fix leftover placeholder in release notes (cherry-pick #14377)
otherwebsite/docs: release notes for 2025.4.1 (cherry-pick #14526)
otherwebsite/docs: release notes for 2025.4.2 (cherry-pick #14868)
featurewebsite/docs: add gateway API to release notes and documentation (cherry-pick #14278)
otherci: cleanup post uv migration (cherry-pick #13538)
fixwebsite/docs: initial permissions: fix usage of term admin (cherry-pick #14300)
fixbrands: fix CSS Migration not updating brands (cherry-pick #14306)
otherwebsite/docs: docs about initial perms (cherry-pick #14263)
fixrbac: fix RoleObjectPermissionTable not showing add_user_to_group (cherry-pick #14312)
fixoutposts: fix tmpdir in containers not being set (cherry-pick #14444)
fixlifecycle: fix ak dump_config (cherry-pick #14445)
fixweb/flows/sfe: fix global background image not being loaded (cherry-pick #14442)
othercore: bump h11 from 0.14.0 to v0.16.0 (cherry-pick #14352)
fixcore: fix session migration when old session can't be loaded (cherry-pick #14466)
otherroot: temporarily deactivate database pool option (cherry-pick #14443)
otherroot: backport SFE Build fix
fixenterprise: fix expired license's users being counted (cherry-pick #14451)
breakingcore: remove OldAuthenticatedSession content type (cherry-pick #14507)
fixcore: fix unable to create group if no enable_group_superuser permission is given (cherry-pick #14510)