authentik 2026.2.2 → 2026.8.5
19 releases · 12 breaking changes · 41 security fixes · 20 advisories fixed
41security12breaking1deprecated53feature126fix
Vulnerabilities fixed by this upgrade
- 7.5 CVE-2026-94613 Denial of Service via Malformed SAML Messages
- 8.1 CVE-2026-94611 Certain stored credentials readable with view permission alone
- 7.4 CVE-2026-94612 Authentication bypass in SAML Sources via assertion confusion and replay
- 8.8 CVE-2026-94609 Privilege escalation via delegated group and user management
- 8.9 CVE-2026-94606 MFA bypass via recipient override in the email authenticator
- 5.4 GHSA-hmrg-vpp4-gj88 Broken access control in Shared Signals Framework stream management
- 8.8 CVE-2026-61574 RAC endpoints and their stored credentials are exposed to any authenticated user, and connections can cross application boundaries
- 8.7 CVE-2026-57580 Account Takeover via SAML NameID Comment Truncation
- 8.6 CVE-2026-54730 Google Chrome device trust stages can be bypassed
- 5.3 CVE-2026-55106 LDAP Source debug endpoint accessible without authorization
- 8.8 CVE-2026-49443 `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API
- 9.8 CVE-2026-49448 SourceStage bypass via empty POST
- 8.5 CVE-2026-47201 XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user
- medium CVE-2026-41569 WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints
- 9.3 CVE-2026-42849 Reflected XSS in SFE
- 8.1 CVE-2026-40172 Privilege Escalation via User PATCH: Superuser Group Assignment Bypasses enable_group_superuser
- 7.4 GHSA-3wf5-rj6w-7527 OAuth2 Redirect URI Poisoning via Auto-Save on Unconfigured Provider
- high CVE-2026-40166 Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/
- 8.7 GHSA-5wcc-hf24-rf5h Unauthenticated Access via Client-Controlled X-Original-URI Header in Nginx Forward-Auth Mode
- 8.7 CVE-2026-40165 SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation
Breaking changes
- breaking web/user: remove slug display in any display mode on the user application library page (#26441) in 2026.8.4
- breaking website/docs: 2026.5: remove preview tag from mtls stage doc in 2026.5.5
- breaking packages/django-postgres-cache: remove custom get_or_set implementation (cherry-pick #23182 to version-2026.5) in 2026.5.4
- breaking website/docs: remove colons from release notes (cherry-pick #23311 to version-2026.5) in 2026.5.4
- breaking website/docs: sources: remove support_level labels from docs (cherry-pick #23389 to version-2026.5) in 2026.5.4
- breaking providers/ldap: remove incorrect validation for code authenticator extraction (cherry-pick #23006 to version-2026.5) in 2026.5.4
- breaking endpoints: remove print line (cherry-pick #22325 to version-2026.5) in 2026.5.0
- breaking website/integrations: remove sp binding field (cherry-pick #22200 to version-2026.5) in 2026.5.0
- breaking flows: remove link to overview for non-internal user (cherry-pick #22362 to version-2026.5) in 2026.5.0
- breaking providers/ldap: remove incorrect validation for code authenticator extraction (cherry-pick #23006 to version-2026.2) in 2026.2.5
- breaking endpoints: remove print line (cherry-pick #22325 to version-2026.2) in 2026.2.4
- breaking website/docs: remove broken version tag from oauth doc (cherry-pick #21628 to version-2026.2) in 2026.2.3
Security changes
- security root: document CNA in SECURITY.md (#26124) in 2026.8.3
- security security: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.5 in 2026.5.7
- security security: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.5 in 2026.5.7
- security security: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.5 in 2026.5.7
- security security: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.5 in 2026.5.7
- security security: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.5 in 2026.5.7
- security security: automated internal backport of patch 1822.sec.patch to authentik-2026.5 in 2026.5.5
- security security: automated internal backport of patch 1817.sec.patch to authentik-2026.5 in 2026.5.5
- security security: automated internal backport of patch 1887.sec.patch to authentik-2026.5 in 2026.5.5
- security security: automated internal backport of patch 1919.sec.patch to authentik-2026.5 in 2026.5.5
- security security: automated internal backport of patch 1934.sec.patch to authentik-2026.5 in 2026.5.5
- security website/docs: document SCIM source trust model and security implications (cherry-pick #22535 to version-2026.5) in 2026.5.4
- security root: Fix SECURITY.md versions (cherry-pick #23370 to version-2026.5) in 2026.5.4
- security website/docs: mark cves CVE-2026-49443 and CVE-2026-49448 (cherry-pick #22808 to version-2026.5) in 2026.5.3
- security root: update security release versions (cherry-pick #22583 to version-2026.5) in 2026.5.2
- security security: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2026.5 in 2026.5.2
- security security: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2026.5 in 2026.5.2
- security security: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2026.5 in 2026.5.2
- security website/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2026.5) in 2026.5.0
- security security: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.2 in 2026.2.7
- security security: automated internal backport of patch 1919.sec.patch to authentik-2026.2 in 2026.2.6
- security security: automated internal backport of patch 1822.sec.patch to authentik-2026.2 in 2026.2.6
- security security: automated internal backport of patch 1934.sec.patch to authentik-2026.2 in 2026.2.6
- security security: automated internal backport of patch 1887.sec.patch to authentik-2026.2 in 2026.2.6
- security security: automated internal backport of patch 1817.sec.patch to authentik-2026.2 in 2026.2.6
- security website/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2026.2) in 2026.2.4
- security security: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2026.2 in 2026.2.4
- security security: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2026.2 in 2026.2.4
- security security: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2026.2 in 2026.2.4
- security internal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-42849.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-41577.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-41569.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-40172.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-40166.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: CVE-2026-40165.sec.patch to authentik-2026.2 in 2026.2.3
- security internal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2026.2 in 2026.2.3
Deprecations
- deprecated website/docs: mark deprecated PostgreSQL options and fix listen settings (cherry-pick #25074 to version-2026.8) in 2026.8.0
Every release in between
fixendpoints: fix MultipleObjectsReturned (cherry-pick #26971 to version-2026.8) (#26972)
otherenterprise/providers/microsoft_entra: skip members already in the group (cherry-pick #26891 to version-2026.8) (#26952)
otherroot: bump cert-related deps due to emudhra (cherry-pick #27068 to version-2026.8) (#27071)
fixweb/stages: Fix stage type errors (cherry-pick #25689 to version-2026.8) (#26194)
fixweb/user: fix agents tab flashing without license (cherry-pick #27069 to version-2026.8) (#27073)
fixcommon/saml: Fix metadata to serve only the leaf of a PEM chain (#26273)
othercore: handle overflow in duration validation (#26680)
fixendpoints: fix error during device lookup with one identifier missing (#26902)
otherendpoints: retain last fact snapshot (#26343)
otherenterprise/requests: show message after successful request (#26587)
fixevents: fix group membership changes with OSS audit middleware (#26477)
featureflows: allow unauthenticated flows for re-authentication (#26785)
fixlifecycle: fix AWS cloudformation template defaults (#26807)
otheroutposts/proxy: don't negotiate HTTP/2 to upstreams (#26281)
otheroutposts/proxy: fetch embedded JWKS over the unix socket, not the browser host (#26448)
otheroutposts/proxy: use HTTP/1.1 for OAuth backchannel requests (#26422)
otherpackages/ak-axum/extract/client_ip: use the leftmost X-Forwarded-For IP (#26353)
fixpackages/ak-common/config: fix list values from env variables parsing (#26081)
otherpackages/django-channels-postgres: refresh pool credentials on connection attempts (#26505)
fixproviders/proxy: fix startup reconcile not being atomic (#26344)
otherproviders/scim: accept a service provider that reports bulk as unsupported (#25057)
fixproviders/scim: fix scim user conflict resolution (#25998)
otherproviders/scim: show remote error details for 4xx/5xx responses (#26906)
otherroot, web, docs: revert pnpm to 11.20.0 on version-2026.8 (#26366)
otherroot: don't fail websocket connections with non-UTF-8 headers (#26688)
fixroot: fix client certificate header forwarded to the mTLS stage (#26438)
otherroot: log full stacktrace for ASGI exception (#26415)
othersources/kerberos, sources/ldap: Save source connections when linking an existing user/group (#26059)
othersources/saml: Fallback NameID (#25713)
fixstages/consent: fix integrity error when re-consenting after consent expired (#26866)
otherweb: Close command palette when opening About (#25734)
fixweb: Fix denied template static form layout. (#26733)
fixweb: Fix disabled token icon buttons. (#25527)
otherweb: resolve themed icon URLs everywhere (#25103)
fixweb/admin: fix device view page and outpost view page (#26383)
otherweb/admin: restore file upload capability check (#26556)
otherweb/admin: show agent connector local auth & compliance status (#26610)
otherweb/admin: update oauth federated provider helptext wording (#26611)
otherweb/elements: reload edit forms after cancel and on pk change (#26892)
otherweb/flows: check if localStorage is available for continuous login (#26267)
fixweb/flows: fix layout shift once initial challenge is loaded (#26758)
fixweb/user: fix requests banner wording (#26586)
breakingweb/user: remove slug display in any display mode on the user application library page (#26441)
otheradmin/files: make file search case-insensitive (#25736)
otherapi: include JSON field relation models in search autocomplete (#26153)
fixblueprints: fix employee_department typo (#26046)
otherchange docker compose to compose (#26087)
fixcore: fix migrations (version-2026.8) (cherry-pick #26208) (#26209)
otherevents: Note in logs when an agent makes a call (#26146)
otherflows: strip login_hint from next on cancel to prevent loop (#26111)
otheroutposts: refresh sessions when impersonation changes (#26086)
otherpackages/ak-axum/extract/client_ip: support X-Forwarded-For with ports (#25682)
fixpolicies: fix policybinding cache invalidation (#25989)
fixproviders/ldap: fix memory leak in the cached searcher (#26028)
otherproviders/oauth: handle token exchange when no signing key is set (#26049)
otherproviders/oauth2: only expose URL-based avatars as picture claim (#26080)
securityroot: document CNA in SECURITY.md (#26124)
fixroot: fix metric gauges for multiprocessor mode (#25882)
otherserver: preserve websocket close code when proxying to outposts (#26090)
othersources/saml: Register ID attributes (#25706)
fixweb/flows: fix hardcoded locale in identification stage's OR_LIST_FORMATTERS (#26017)
featureweb/scim: Add gitlab compatibility option to form (#26154)
otherblueprints: emit draft-07 definitions instead of $defs (cherry-pick #24981 to version-2026.8)
featurewebsite/docs: add object attributes doc (cherry-pick #24437 to version-2026.8)
fixproviders/oauth2: fix dcr missing csrf_exempt (cherry-pick #24983 to version-2026.8)
fixweb/admin: fix missing preview banner for object attributes (cherry-pick #24982 to version-2026.8)
otherenterprise/requests: optimize db for requestable apps (cherry-pick #24984 to version-2026.8)
otherenterprise/endpoints/connectors/fleet: decrease page size (cherry-pick #24995 to version-2026.8)
fixweb/elements: fix prioritization in form serialization for dotted input-fields (cherry-pick #24987 to version-2026.8)
othertasks: aggregate status from logs instead of legacy field (cherry-pick #24792 to version-2026.8)
otherenterprise/stages/source: configurable failure action (cherry-pick #24963 to version-2026.8)
otherendpoints: handle error in facts (cherry-pick #25028 to version-2026.8)
featuresources/saml: add audience override field for SAML sources (cherry-pick #25029 to version-2026.8)
fixweb: Fix content_left/right layouts. (cherry-pick #25025 to version-2026.8)
featurewebsite/docs: add 2026.8 release note for task status change (cherry-pick #25044 to version-2026.8)
otheroutposts/proxy: include query string in post-authentication redirect (cherry-pick #25043 to version-2026.8)
otherwebsite/docs: preserve host and port in proxy provider nginx redirects (cherry-pick #24991 to version-2026.8)
othercore: bump goauthentik/fips-python from 3.14.6-slim-trixie-fips to 3.14.7-slim-trixie-fips in /lifecycle/container (cherry-pick #25049 to version-2026.8)
fixweb: Fix mangled nested CSS in compatibility mode. (cherry-pick #25053 to version-2026.8)
otherci: require test-rust to pass (cherry-pick #25066 to version-2026.8)
fixproviders/scim: fix group membership removals (cherry-pick #25024 to version-2026.8)
otherwebsite/docs: correct proxy unauthenticated path regex reference (cherry-pick #25077 to version-2026.8)
featurewebsite/docs: match UI label capitalization and add a style rule (cherry-pick #25080 to version-2026.8)
otherwebsite/docs: update source field labels renamed in 2026.8 (cherry-pick #25072 to version-2026.8)
otherpackages/django-dramatiq-postgres/broker: chunked purge queryset (cherry-pick #25102 to version-2026.8)
fixenterprise/requests: fix API schema for grant requests (cherry-pick #25111 to version-2026.8)
fixweb/user: fix request access URL from agent not working (cherry-pick #25113 to version-2026.8)
fixproviders/oauth2: fix token exchange provider lookup for actor/subject (cherry-pick #25110 to version-2026.8)
featureenterprise/endpoints/connectors/agent: add login_hint to auth_ia (cherry-pick #25122 to version-2026.8)
othercore: scope user path_startswith filter to the path subtree (cherry-pick #25093 to version-2026.8)
featurewebsite/docs: agents: add doc (cherry-pick #24826 to version-2026.8)
othersources/telegram: restore next= redirect after pre_authentication_flow (cherry-pick #22762 to version-2026.8)
othercore: delete all user sessions when user is deactivated (cherry-pick #25088 to version-2026.8)
deprecatedwebsite/docs: mark deprecated PostgreSQL options and fix listen settings (cherry-pick #25074 to version-2026.8)
otherweb: bump dompurify from 3.4.12 to 3.4.13 in /web (cherry-pick #24892 to version-2026.8)
featurewebsite/docs: add access requests doc (cherry-pick #24457 to version-2026.8)
otherproviders/oauth2: send back-channel logout requests when a user is deactivated (cherry-pick #24718 to version-2026.8)
othercore: bump h2 from 0.4.15 to 0.4.16 (cherry-pick #25183 to version-2026.8)
fixstages/email: fix test_email ignoring the given stage (cherry-pick #25166 to version-2026.8)
featureproviders/radius: allow empty message authenticator (cherry-pick #25097 to version-2026.8)
featurewebsite/docs: add OBO (cherry-pick #25149 to version-2026.8)
featurewebsite/docs: 2026.8 release notes: add features and links to docs (cherry-pick #25194 to version-2026.8)
+1 more item in the release notesotherci: remove the Google Chrome apt source in setup (cherry-pick #25990 to version-2026.5)
fixlib/expression: fix PickleError due to resolver match when using ak_call_policy (cherry-pick #25763 to version-2026.5)
fixweb/source/flows: fix flicker after webauthn (cherry-pick #25454 to version-2026.5)
othercore: bump rustls (cherry-pick #26142 to version-2026.5)
featurewebsite: add umami (cherry-pick #26460 to version-2026.5)
otherpackages/django-channels-postgres: refresh pool credentials on connection attempts (cherry-pick #26505 to version-2026.5)
otherweb/flows: check if localStorage is available for continuous login (cherry-pick #26267 to version-2026.5)
otherroot: don't fail websocket connections with non-UTF-8 headers (cherry-pick #26688 to version-2026.5)
fixstages/consent: fix integrity error when re-consenting after consent expired (cherry-pick #26866 to version-2026.5)
otherci: switch version bump to action, like platform repo (cherry-pick #26949 to version-2026.5)
otherroot: bump cert-related deps due to emudhra (cherry-pick #27068 to version-2026.5)
otherci: add working dir prefix to file paths (cherry-pick #24319 to version-2026.5)
fixendpoints/connectors/agent: fix auth schema correctly (cherry-pick #24327 to version-2026.5)
fixenterprise/endpoints/connectors/fleet: fix exception when host has no policies (cherry-pick #24355 to version-2026.5)
fixbrands: fix schema for current brand's flags (cherry-pick #24376 to version-2026.5)
othercore: bump library/golang from 1.26.2-trixie to 1.26.5-trixie in /lifecycle/container
otherproviders/scim: ignore key casing in SCIM responses (cherry-pick #24441 to version-2026.5)
othercore: bump django from 5.2.15 to v5.2.16 (cherry-pick #24526 to version-2026.5)
fixfix pipeline for version 2026.5
otherendpoints/agent: return 400 instead of 500 for invalid Platform SSO token requests (cherry-pick #24588 to version-2026.5)
fixendpoints/agent: fix Secure Enclave key dropped on first Platform SSO user registration (cherry-pick #24587 to version-2026.5)
featurewebsite/docs: agent: Add API access scope requirement (cherry-pick #24567 to version-2026.5)
fixproviders/scim: fix scim changed detection for nested attributes (cherry-pick #24332 to version-2026.5)
otherwebsite/docs: correct authentik Agent CLI reference and macOS logging paths (cherry-pick #24605 to version-2026.5)
otherpackages/django-dramatiq-postgres: minor fixes (cherry-pick #23181 to version-2026.5)
fixcore: fix group source connection source object (cherry-pick #24626 to version-2026.5)
otherroot: don't include debug info for rust release profile (cherry-pick #24664 to version-2026.5)
featurewebsite/docs: welcome email notification rule: Add LDAP exception (cherry-pick #24672 to version-2026.5)
featurewebsite/docs: Add feedback from previous agent pr (cherry-pick #24713 to version-2026.5)
fixblueprints: fix mismatched stage name in example 2fa login flow (cherry-pick #24668 to version-2026.5)
featureblueprints: handle invalid yaml, add dry run to apply_blueprint (cherry-pick #24813 to version-2026.5)
fixproviders/oauth2: fix missing authorization event for oauth provider, add tests (cherry-pick #24819 to version-2026.5)
fixweb/flows: fix missing required flag on password input (cherry-pick #24831 to version-2026.5)
fixproviders/scim: fix display of SCIMRequestException (2026.8) (cherry-pick #24833 to version-2026.5)
fixstages/email: fix test_email ignoring the given stage (cherry-pick #25166 to version-2026.5)
featureproviders/radius: allow empty message authenticator (cherry-pick #25097 to version-2026.5)
fixendpoints/connectors: fix integrity error when device with same name exists already (cherry-pick #25237 to version-2026.5)
featurecore: add user type-active-username index (cherry-pick #25223 to version-2026.5)
featurecore: set days=1 as default token duration for new installs (cherry-pick #25341 to version-2026.5)
fixlib/expression: fix policy request context pollution (cherry-pick #25462 to version-2026.5)
fixworker: fix healthcheck paths (cherry-pick #24481 to version-2026.5)
fixtenants/settings: fix flags response (cherry-pick #25616 to version-2026.5)
fixweb/admin: fix schedule form (cherry-pick #25778 to version-2026.5)
securitysecurity: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.5
fixlifecycle: fix server prometheus metrics getting registered early with pid instead of worker ID (cherry-pick #25883 to version-2026.5)
securitysecurity: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.5
featurewebsite/docs: add release notes for 2026.2.7 (cherry-pick #25979 to version-2026.5)
featurewebsite/docs: add release notes for 2026.5.7 (cherry-pick #25980 to version-2026.5)
+21 more items in the release notesotherweb/flow: revert locale-driven flow re-request from FlowExecutor (cherry-pick #24050 to version-2026.5)
otherlifecycle/container: drop curl and runit (cherry-pick #24008 to version-2026.5)
otherenterprise/endpoints/connectors/fleet: pass populate_policies (cherry-pick #24108 to version-2026.5)
otherpackages/django-dramatiq-postgres/broker: use positive state filter for pending messages (cherry-pick #24074 to version-2026.5)
fixendpoints/connectors/agent: fix auth schema for device endpoints (cherry-pick #24164 to version-2026.5)
otherpolicies: filter policy engine (cherry-pick #24025 to version-2026.5)
otherwebsite/docs: cleanup 07-12: refresh contributor guidance (cherry-pick #23969 to version-2026.5)
otherinternal/config: make storage file paths overwritable via env vars (cherry-pick #24177 to version-2026.5)
fixstages/captcha: fix hcaptcha height (#20901)
featureproviders/scim: exclude read-only id from group PATCH payload and fix null-members add check (cherry-pick #23950 to version-2026.5)
fixproviders/scim: fix enum warning when de-serializing (cherry-pick #23553 to version-2026.5)
fixproviders/scim: fix non-schema compliant group member removal (cherry-pick #23800 to version-2026.5)
fixroot: fix make gen-diff command (cherry-pick #22548 to version-2026.5)
othercore: bump pyjwt from 2.11.0 to 2.13.0 (cherry-pick #22562 to version-2026.5)
othercore: Form friendly error on uniqueness constraint. (cherry-pick #23864 to version-2026.5)
fixweb/admin: fix app view failing when no events permissions (cherry-pick #24131 to version-2026.5)
fixroot: fix make gen-changelog (cherry-pick #24122 to version-2026.5)
otherroot: in-process per-IP rate throttle (#23015)
othertests/openid_conformance: migrate to upstream images (cherry-pick #23828 to version-2026.5)
otherendpoints: handle exception in connector controller sync setup (cherry-pick #23852 to version-2026.5)
fixweb/flows: fix race condition in continuous login and support source stages in authentication flows (cherry-pick #23049 to version-2026.5)
fixweb: fix table refresh button not refreshing table data (cherry-pick #23780 to version-2026.5)
featureweb/admin: licensing: add usage totals (cherry-pick #23665 to version-2026.5)
fixweb: Fix Log Viewer Intersection Observer. (cherry-pick #23861 to version-2026.5)
fixstages/email: fix ungrammatical expiry time in password reset templates (cherry-pick #22758 to version-2026.5)
otherwebsite/docs: cleanup 07-12: update integration routes (cherry-pick #23960 to version-2026.5)
otherwebsite/docs: cleanup 07-12: update documentation URLs (cherry-pick #23961 to version-2026.5)
fixwebsite/docs: cleanup 07-12: fix Admin interface tab label (cherry-pick #23965 to version-2026.5)
otherproviders/scim: improve error display when error doesn't conform to scim schema (cherry-pick #23955 to version-2026.5)
fixlib/sync/outgoing: fix discover running for each page (cherry-pick #24016 to version-2026.5)
breakingwebsite/docs: 2026.5: remove preview tag from mtls stage doc
featureapi/search: add number and boolean support in AKQL queries on JSON fields (#23418) (cherry-pick #24028 to version-2026.5)
othersources/oauth: improve id_token validation for apple source (cherry-pick #24017 to version-2026.5)
otherpackages/django-dramatiq-postgres/broker: close unusable PostgreSQL connections (cherry-pick #24023 to version-2026.5)
securitysecurity: automated internal backport of patch 1822.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch 1817.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch 1887.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch 1919.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch 1934.sec.patch to authentik-2026.5
otherwebsite/docs: release notes for 2026.2.6 (cherry-pick #24069 to version-2026.5)
otherwebsite/docs: release notes for 2026.5.5 (cherry-pick #24070 to version-2026.5)
featurewebsite/integrations: dokuwiki: add post logout and logout urls (cherry-pick #22984 to version-2026.5)
otherwebsite/docs: additional scim provider docs (cherry-pick #22135 to version-2026.5)
otherroot: bump pyo3 (cherry-pick #23036 to version-2026.5)
securitywebsite/docs: document SCIM source trust model and security implications (cherry-pick #22535 to version-2026.5)
fixweb: Fix user list default paths. (cherry-pick #23062 to version-2026.5)
fixweb/i18n: Fix stale flow locale, unsynchronized locale selector options (cherry-pick #23007 to version-2026.5)
fixweb: Fix stale clipboard tokens, untranslated labels (cherry-pick #23063 to version-2026.5)
featurewebsite/docs: add Splunk event forwarding docs (cherry-pick #22938 to version-2026.5)
fixcore: fix Invitation Emails Ignoring Selected Template (cherry-pick #23122 to version-2026.5)
otherpackages/django-dramatiq-postgres/broker: purge at start of loop to ensure it runs (cherry-pick #23185 to version-2026.5)
fixweb/stages/identification: Fix passkey autofill dropdown not showing on the identification stage (cherry-pick #23187 to version-2026.5)
fixwebsite/docs: fix broken custom email template example (cherry-pick #23191 to version-2026.5)
breakingpackages/django-postgres-cache: remove custom get_or_set implementation (cherry-pick #23182 to version-2026.5)
otherwebsite: migrate brand assets to pkg (cherry-pick #22336 to version-2026.5)
fixpackages/django-postgres-cache: fix naive datetime warning (cherry-pick #23033 to version-2026.5)
fixpackages/django-dramatiq-postgres/broker: fix race condition in broker causing completed tasks to be repeated (cherry-pick #23218 to version-2026.5)
otherwebsite/docs: improve email authenticator docs (cherry-pick #23226 to version-2026.5)
breakingwebsite/docs: remove colons from release notes (cherry-pick #23311 to version-2026.5)
otherwebsite/docs: clarify user and group filtering on scim provider (cherry-pick #22502 to version-2026.5)
securityroot: Fix SECURITY.md versions (cherry-pick #23370 to version-2026.5)
breakingwebsite/docs: sources: remove support_level labels from docs (cherry-pick #23389 to version-2026.5)
othercore: bump goauthentik/fips-debian and fips-python in /lifecycle/container (cherry-pick #23362 to version-2026.5)
fixwebsite/docs: fix 2026.5 release notes mentioning docker-compose.yml (cherry-pick #23385 to version-2026.5)
featureproviders/scim: allow failures during discovery (cherry-pick #23357 to version-2026.5)
featurewebsite/docs: Add improved akql docs (cherry-pick #22693 to version-2026.5)
otherproviders/scim: account for users with no email during discovery (cherry-pick #23417 to version-2026.5)
fixweb/admin: fix spacing issues in wizard (cherry-pick #23484 to version-2026.5)
otherpolicies: skip cache invalidation on User last_login update (cherry-pick #23159 to version-2026.5)
othertasks: avoid useless query on monitoring_set (cherry-pick #23161 to version-2026.5)
otherpackages/django-postgres-cache: avoid regex queries when listing keys if possible (cherry-pick #23160 to version-2026.5)
otherbrands: select_related models accessed in the hot path (cherry-pick #23162 to version-2026.5)
othersources/ldap: avoid re-creating connections to LDAP server (cherry-pick #23520 to version-2026.5)
fixtasks/schedules: fix paused schedules getting unpaused on startup (cherry-pick #23521 to version-2026.5)
fixproviders/*: fix missing declaration for can_discover for outgoing sync providers (cherry-pick #23035 to version-2026.5)
featurewebsite/docs: add expression policy example for welcome emails on user creation (cherry-pick #23486 to version-2026.5)
featuretasks: add pre_delete for TasksModel to avoid OOM when deleting object with many tasks linked (cherry-pick #23664 to version-2026.5)
breakingproviders/ldap: remove incorrect validation for code authenticator extraction (cherry-pick #23006 to version-2026.5)
featurewebsite/docs: add release notes for 2026.2.5 (cherry-pick #23816 to version-2026.5)
fixweb: Fix outline selector, lack of outline on focused checkboxes. (cherry-pick #23260 to version-2026.5)
fixweb, core: Fix server-side message race condition, type mismatch. (cherry-pick #23151 to version-2026.5)
+17 more items in the release notesotherwebsite/docs: 2026.5.2 release notes (cherry-pick #22721 to version-2026.5)
otherwebsite/docs: 2026.2.4 release notes (cherry-pick #22720 to version-2026.5)
otherwebsite/docs: 2025.12.6 release notes (cherry-pick #22719 to version-2026.5)
otherwebsite/docs: update endpoint SSH docs (cherry-pick #22759 to version-2026.5)
fixtests/e2e: fix proxy tests failing due to in-use port (cherry-pick #22785 to version-2026.5)
fixenterprise/providers/scim: fix interactive OAuth overriding refresh_token (cherry-pick #22858 to version-2026.5)
securitywebsite/docs: mark cves CVE-2026-49443 and CVE-2026-49448 (cherry-pick #22808 to version-2026.5)
featurewebsite/docs: add oidc issuer information (cherry-pick #22556 to version-2026.5)
otherwebsite/docs: update binding wizard labels (cherry-pick #22869 to version-2026.5)
fixweb/admin: fix Docker outpost integration form CA Cert filter (cherry-pick #22863 to version-2026.5)
otherblueprints: handle integrity exception when applying blueprints (cherry-pick #22599 to version-2026.5)
otherwebsite/docs: clean up proxy provider docs (cherry-pick #22870 to version-2026.5)
fixendpoints/connectors/agent: fix exception with invalid auth type (cherry-pick #22943 to version-2026.5)
fixproviders/radius: fix panic in log due to type (cherry-pick #22965 to version-2026.5)
fixwebsite: fix package-lock.json (version-2026.5)
otherweb/polyfill: polyfill customElements.getName for Safari < 17.4 (cherry-pick #22940 to version-2026.5)
othercore: bump django from 5.2.14 to v5.2.15 (cherry-pick #22956 to version-2026.5)
otherproviders/oauth: skip post logout redirect matching if none are saved on the provider (cherry-pick #22718 to version-2026.5)
featurewebsite/docs: add release notes for 2026.5.3 (cherry-pick #22976 to version-2026.5)
fixwebsite/docs: Fix release notes cards (cherry-pick #22554 to version-2026.5)
securityroot: update security release versions (cherry-pick #22583 to version-2026.5)
featureendpoints/connectors/agent: allow federated auth via ssh hostkey lookup (cherry-pick #22594 to version-2026.5)
otherwebsite/docs: Bump package-lock
fixproviders/radius: fix eap debug logging (cherry-pick #22551 to version-2026.5)
fixevents: fix Event.log_deprecation not checking that cause is a string (cherry-pick #22598 to version-2026.5)
fixpackages/ak-common/db: fix conn_max_age causing spinning (cherry-pick #22679 to version-2026.5)
fixpackages/ak-common/db: fix certificates options not allowing file paths (cherry-pick #22680 to version-2026.5)
fixproviders/oauth2: fix session decode when upgrading from 2026.2 (cherry-pick #22684 to version-2026.5)
fixenterprise/providers/scim: fix last_updated for OAuth interactive (cherry-pick #22678 to version-2026.5)
securitysecurity: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2026.5
breakingendpoints: remove print line (cherry-pick #22325 to version-2026.5)
featurewebsite/docs: release notes 2026.5: add section about package reduction (cherry-pick #22308 to version-2026.5)
securitywebsite/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2026.5)
featureenterprise/providers/scim: add support for interactive OAuth2 (cherry-pick #22072 to version-2026.5)
fixwebsite/docs: fix typos and style issues (cherry-pick #22141 to version-2026.5)
otherwebsite/integrations: Update all guides to match auto generated issuer (cherry-pick #22180 to version-2026.5)
breakingwebsite/integrations: remove sp binding field (cherry-pick #22200 to version-2026.5)
fixwebsite/docs: 2026.5 release notes: fix performance improvements wording (cherry-pick #22307 to version-2026.5)
fixweb: Fix issue where default user path is not preferred. (cherry-pick #22139 to version-2026.5)
featurewebsite/docs: Add invitation wizard docs (cherry-pick #22069 to version-2026.5)
otherwebsite/docs, integrations: SAML docs endpoint updates (cherry-pick #22197 to version-2026.5)
featureproviders/saml: Add sls to saml overview (cherry-pick #22183 to version-2026.5)
breakingflows: remove link to overview for non-internal user (cherry-pick #22362 to version-2026.5)
otherenterprise/stages/mtls: freeze time for expired certs (cherry-pick #22411 to version-2026.5)
featurewebsite: Docs and README new screenshots (cherry-pick #22341 to version-2026.5)
otherweb, website: Update name to application dashboard (cherry-pick #22190 to version-2026.5)
otherweb/table: fetch on first render when already visible (cherry-pick #22376 to version-2026.5)
otherwebsite/docs: providers: update UI terms (cherry-pick #22136 to version-2026.5)
otherproviders/saml: Properly import audience from metadata. (cherry-pick #22181 to version-2026.5)
featurewebsite/docs: add integrations to 2026.5 release notes (cherry-pick #22416 to version-2026.5)
otherroot: configure freezegun to exclude cryptography (cherry-pick #22442 to version-2026.5)
featurewebsite/docs: first batch of updates for new Binding wizard (cherry-pick #22393 to version-2026.5)
fixroot: fix gitignore binary paths (cherry-pick #22445 to version-2026.5)
otherenterprise/stages/mtls: attempt fix freezegun (cherry-pick #22474 to version-2026.5)
fixoutposts: fix stale version in OutpostState (cherry-pick #22487 to version-2026.5)
otherwebsite/docs: update saml source to include details on force authenti… (cherry-pick #22488 to version-2026.5)
featurewebsite/docs: add global to values.yaml snippets and update version (cherry-pick #22524 to version-2026.5)
othercore: bump goauthentik/fips-python from 3.14.3-slim-trixie-fips to 3.14.5-slim-trixie-fips in /lifecycle/container (cherry-pick #22518 to version-2026.5)
featurewebsite/docs: release notes: add absorb lms to integrations (cherry-pick #22534 to version-2026.5)
otherproviders/saml: handle XML declarations in unified endpoint (cherry-pick #22455 to version-2026.5)
fixevents: fix certificate typo (cherry-pick #22542 to version-2026.5)
otherwebsite/release: Release notes updates (cherry-pick #22543 to version-2026.5)
otherlifecycle/container: drop curl and runit (cherry-pick #24008 to version-2026.2)
otherpolicies: filter policy engine (cherry-pick #24025 to version-2026.2)
otherci: add working dir prefix to file paths (cherry-pick #24319 to version-2026.2)
fixproviders/scim: fix scim changed detection for nested attributes (cherry-pick #24332 to version-2026.2)
othercore: bump django from 5.2.16 to v5.2.17 (cherry-pick #24793 to version-2026.2)
otherrbac: use constant-time comparison in SecretKeyFilter (cherry-pick #24888 to version-2026.2)
othercore: return the intended status code from error views for all request methods (cherry-pick #24902 to version-2026.2)
otherserver/core: handle unsupported HTTP method (cherry-pick #22498 to version-2026.2)
otherstages/identification: dynamic captcha keys when stage embedded in identification stage (cherry-pick #24079 to version-2026.2)
otherlib: avoid DNS resolution in fqdn_rand (cherry-pick #25728 to version-2026.2)
otherci: bump golangci lint (cherry-pick #25513 to version-2026.2)
securitysecurity: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.2
othertests/openid_conformance: migrate to upstream images (cherry-pick #23828 to version-2026.2)
fixlib/sync/outgoing: fix discover running for each page (cherry-pick #24016 to version-2026.2)
othersources/oauth: improve id_token validation for apple source (cherry-pick #24017 to version-2026.2)
otherpackages/django-dramatiq-postgres/broker: close unusable PostgreSQL connections (cherry-pick #24023 to version-2026.2)
securitysecurity: automated internal backport of patch 1919.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1822.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1934.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1887.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1817.sec.patch to authentik-2026.2
otherwebsite/docs: release notes for 2026.2.6 (cherry-pick #24069 to version-2026.2)
otherwebsite/docs: 2026.2.4 release notes (cherry-pick #22720 to version-2026.2)
otherwebsite/docs: 2025.12.6 release notes (cherry-pick #22719 to version-2026.2)
fixtests/e2e: fix proxy tests failing due to in-use port (cherry-pick #22785 to version-2026.2)
fixweb/admin: fix Docker outpost integration form CA Cert filter (cherry-pick #22863 to version-2026.2)
otherblueprints: handle integrity exception when applying blueprints (cherry-pick #22599 to version-2026.2)
fixendpoints/connectors/agent: fix exception with invalid auth type (cherry-pick #22943 to version-2026.2)
fixproviders/radius: fix panic in log due to type (cherry-pick #22965 to version-2026.2)
othercore: bump django from 5.2.14 to v5.2.15 (cherry-pick #22956 to version-2026.2)
otheradmin/files: sign custom-domain S3 URLs for the final host (cherry-pick #21704 to version-2026.2)
fixpackages/django-postgres-cache: fix naive datetime warning (cherry-pick #23033 to version-2026.2)
fixwebsite/docs: fix 2026.2 release notes docker compose mention take 2 (cherry-pick #23388 to version-2026.2)
otherpolicies: skip cache invalidation on User last_login update (cherry-pick #23159 to version-2026.2)
othertasks: avoid useless query on monitoring_set (cherry-pick #23161 to version-2026.2)
fixpackages/django-dramatiq-postgres/broker: fix race condition in broker causing completed tasks to be repeated (cherry-pick #23218 to version-2026.2)
fixtasks/schedules: fix paused schedules getting unpaused on startup (cherry-pick #23521 to version-2026.2)
otherbrands: select_related models accessed in the hot path (cherry-pick #23162 to version-2026.2)
fixproviders/*: fix missing declaration for can_discover for outgoing sync providers (cherry-pick #23035 to version-2026.2)
othercore: preserve encoded avatar URLs (cherry-pick #23225 to version-2026.2)
fixweb/flows: fix race condition in continuous login and support source stages in authentication flows (cherry-pick #23049 to version-2026.2)
fixweb, core: Fix server-side message race condition, type mismatch. (cherry-pick #23151 to version-2026.2)
fixweb: Fix issue where default user path is not preferred. (cherry-pick #22139 to version-2026.2)
breakingproviders/ldap: remove incorrect validation for code authenticator extraction (cherry-pick #23006 to version-2026.2)
featureproviders/SCIM: Add discover support (cherry-pick #20658 to version-2026.2)
featureproviders/scim: allow failures during discovery (cherry-pick #23357 to version-2026.2)
otherproviders/scim: account for users with no email during discovery (cherry-pick #23417 to version-2026.2)
fixstages/captcha: fix hcaptcha height (#20901) (2026.2)
otherroot: in-process per-IP rate throttle (#23015) (2026.2)
otherci: remove GHA-based cherry-pick (cherry-pick #23801 to version-2026.2)
featurewebsite/docs: add release notes for 2026.2.5 (cherry-pick #23816 to version-2026.2)
breakingendpoints: remove print line (cherry-pick #22325 to version-2026.2)
securitywebsite/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2026.2)
otherenterprise/stages/mtls: freeze time for expired certs (cherry-pick #22411 to version-2026.2)
otherenterprise/stages/mtls: attempt fix freezegun (cherry-pick #22474 to version-2026.2)
fixoutposts: fix stale version in OutpostState (cherry-pick #22487 to version-2026.2)
featurewebsite/docs: add global to values.yaml snippets and update version (cherry-pick #22524 to version-2026.2)
othercore: bump goauthentik/fips-python from 3.14.3-slim-trixie-fips to 3.14.5-slim-trixie-fips in /lifecycle/container (cherry-pick #22518 to version-2026.2)
featureendpoints/connectors/agent: allow federated auth via ssh hostkey lookup (cherry-pick #22594 to version-2026.2)
fixproviders/radius: fix eap debug logging (cherry-pick #22551 to version-2026.2)
fixcore: fix filter_not_expired not accepting positional arguments (2026.2)
otherci: fix docs not having correct js version setup (2026.2)
fixtenants: fix test teardown (version-2026.2)
securitysecurity: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch GHSA-xp7f-xjjx-gwm8.sec.patch to authentik-2026.2
othercore: bump django from v5.2.12 to 5.2.13 (cherry-pick #21520 to version-2026.2)
fixendpoints: fix tasks failing (cherry-pick #20904 to version-2026.2)
featurewebsite/docs: add another sentence to First Steps about restricting access to apps (cherry-pick #21517 to version-2026.2)
otherlib/sync/outgoing: avoid expensive query to get number of sync pages (cherry-pick #21575 to version-2026.2)
otherpackages/django-dramatiq-postgres: reset db connections in raise_connection_error (cherry-pick #21577 to version-2026.2)
fixproviders/oauth2: fix time logic in refresh_token_threshold (cherry-pick #21537 to version-2026.2)
fixblueprints: fix reconcile calling @property (cherry-pick #21576 to version-2026.2)
featurewebsite/docs: add a single page about our user interface, document Consent stage (cherry-pick #20533 to version-2026.2)
breakingwebsite/docs: remove broken version tag from oauth doc (cherry-pick #21628 to version-2026.2)
otherweb/flows: prevent leader tab deadlock in continuous login flow (cherry-pick #21583 to version-2026.2)
featureproviders/oauth2: allow cross provider token introspection for federated providers (cherry-pick #21513 to version-2026.2)
otherproviders/oauth2: don't auto-set redirect_uri (cherry-pick #21746 to version-2026.2)
otherci: fix postgres path for postgres 18 tests (2026.2) (#21767)
featurewebsite/docs: add authorization header info to all proxy configs (cherry-pick #21664 to version-2026.2)
otherproviders/oauth2: clip device authorization scope against the provider's ScopeMapping set (cherry-pick #21701 to version-2026.2)
otherwebsite/docs: improve social login docs titles (cherry-pick #21816 to version-2026.2)
fixproviders/radius: fix message authenticator validation (cherry-pick #21824 to version-2026.2)
otherweb/packages: Rework SFE rendering (cherry-pick #21833 to version-2026.2)
fixcore: fix search for app entitlements failing (cherry-pick #21944 to version-2026.2)
otherrbac: ensure migration 0056 runs before 0010 removes group field (cherry-pick #21964 to version-2026.2)
otherroot: update django to 5.2.14 (cherry-pick #22064 to version-2026.2)
otherpackages/django-dramatiq-postgres/broker: avoid task processing stopping on decode error (cherry-pick #22110 to version-2026.2)
othertenants/settings: present unset flags as False (cherry-pick #22162 to version-2026.2)
fixevents: fix destination_group_obj not being nullable (cherry-pick #22161 to version-2026.2)
fixinternal: fix lint
securityinternal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-42849.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-41577.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-41569.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-40172.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-40166.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: CVE-2026-40165.sec.patch to authentik-2026.2
securityinternal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2026.2
otherwebsite/docs: release notes for 2025.12.5 and 2026.2.3 (cherry-pick #22310 to version-2026.2)