Query limits enforced and restored on list endpoints
ZITADEL 4.19.5 restores and enforces query limits on v1 and v2 API list endpoints, prevents loading all projects on console startup, improves sign verification with server secrets, and requires consent for device authorizations.
4.19.5 (2026-10-15)
Bug Fixes
- api: enforce query limits on v2 list endpoints (#12875) (247d8ce), closes zitadel/zitadel#12881 zitadel/zitadel#12876
- api: restore query limits on v1 list endpoints (#12876) (fe4f4fd), closes zitadel/zitadel#12875 #2342 #2433 #2383 #2612 #2820 #2818 #2838 #3075 #3096 zitadel/zitadel#12881 zitadel/zitadel#12875
- console: don't load all projects on startup and prepare for list limits (#12881) (95dae90), closes zitadel/zitadel#12875 zitadel/zitadel#12876 #12875 #12875 #12876 #12876
- login: sign user verification check and IdP link proof with server secret (e32ba7a)
- reject invalid public host headers instead of ignoring them (6493aa9)
- require consent and authorization to approve device authorizations (a618740)
Source: original entry ↗
More from ZITADEL
Follow ZITADEL to get its new changes in your feed and email digest.
v4.19.4 Bug Fixes
This release includes bug fixes for the async execution worker context not having the instance ID set, corrects the ID order in the invite code notification handler, and improves handling of finalized unique-constraint backfill and exclusive owner deletes.
Performance improvements for user queries
Improved performance of user listing queries by indexing users by instance and organization, and stopped expanding login names for every ListUsers row to reduce database load.
v4.19.2 – Security fixes for SAML, session cookies, and impersonation
This release fixes three security vulnerabilities including SAML identity-provider confusion leading to account takeover, unsigned Login V2 session cookie vulnerability, and unauthorized administrator impersonation. All 4.x deployments should upgrade and configure the new ZITADEL_SESSION_COOKIE_SECRET for Login V2.