v4.15.2
Bug fixes including JWT IdP claim validation, client ID verification during OAuth flows, connection handling after migrations, PKCE application for OAuth/OIDC providers, and JWT audience management. Also improves login handling for passkey registration and custom font loading in branding.
4.15.2 (2026-06-17)
Bug Fixes
- always validate exp and iat claims of JWT IdPs (4925fab)
- client_id verification during code exchange and refresh token flows (5624030)
- connection handling in setup after migration steps 40, 64 and 70 (#12293) (c53d977)
- eventstore: allow overwriting resource owner of events (#12261) (a939b84)
- idp: apply PKCE when building OAuth and OIDC providers (#12247) (ab7c6c0), closes #12036 #12054
- jwt idp: manage and validate audience (999e2bb)
- login: accept IDP sessions on passkey registration (#12275) (add46e0)
- login: load custom font from branding settings and allow in CSP (#12279) (9f1561d), closes #11200
- remove unnecessary entry from default denylist (#12294) (1ca1fbd)
- use protected http client for outgoing connections (b6f7808)
Source: original entry ↗
More from ZITADEL
Follow ZITADEL to get its new changes in your feed and email digest.
Query limits enforced and restored on list endpoints
ZITADEL 4.19.5 restores and enforces query limits on v1 and v2 API list endpoints, prevents loading all projects on console startup, improves sign verification with server secrets, and requires consent for device authorizations.
v4.19.4 Bug Fixes
This release includes bug fixes for the async execution worker context not having the instance ID set, corrects the ID order in the invite code notification handler, and improves handling of finalized unique-constraint backfill and exclusive owner deletes.
Performance improvements for user queries
Improved performance of user listing queries by indexing users by instance and organization, and stopped expanding login names for every ListUsers row to reduce database load.