Fix4.16.2
v4.16.2 Bug Fixes and Performance Improvements
This release includes critical security fixes for login flows including prevention of external-IDP account hijacking and required authentication before enrollment, plus improvements to random string generation and ListUsers query performance.
4.16.2 (2026-07-29)
Bug Fixes
- improve random string generation (#12266) (34345ea)
- login: prevent external-IDP account pre-hijack in Login V1 (917ade3)
- login: redirect to external IdP after domain discovery regardless of registration policy (#12369) (c4ba5a1), closes #12021 #12023
- login: require authentication before WebAuthn/U2F and TOTP/OTP enrollment (c20d613)
- use protected http client for org domain HTTP verification (35122e4)
Performance Improvements
securityloginperformanceidpauth
Source: original entry ↗