Fix4.15.2
v4.15.2
Bug fixes including JWT IdP claim validation, client ID verification during OAuth flows, connection handling after migrations, PKCE application for OAuth/OIDC providers, and JWT audience management. Also improves login handling for passkey registration and custom font loading in branding.
4.15.2 (2026-06-17)
Bug Fixes
- always validate exp and iat claims of JWT IdPs (4925fab)
- client_id verification during code exchange and refresh token flows (5624030)
- connection handling in setup after migration steps 40, 64 and 70 (#12293) (c53d977)
- eventstore: allow overwriting resource owner of events (#12261) (a939b84)
- idp: apply PKCE when building OAuth and OIDC providers (#12247) (ab7c6c0), closes #12036 #12054
- jwt idp: manage and validate audience (999e2bb)
- login: accept IDP sessions on passkey registration (#12275) (add46e0)
- login: load custom font from branding settings and allow in CSP (#12279) (9f1561d), closes #11200
- remove unnecessary entry from default denylist (#12294) (1ca1fbd)
- use protected http client for outgoing connections (b6f7808)
securityoauthjwtidploginbugfix
Source: original entry ↗