v4.17.3 Bug Fixes
This release includes critical bug fixes for encryption of IDP intent tokens, IDP linking authorization logic, translation of authentication strings, and organization-level auth method permissions.
4.17.3 (2026-09-04)
Bug Fixes
- crypto: use authenticated encryption for IDP intent tokens (41b1114)
- login: authorize IDP linking via enrollment guard, not isSessionValid (a53fbc4)
- login: translate authentication and OTP strings (#12668) (739e91e), closes #12481 #12226
- security: check auth method permission on the user's organization (20f0984)
Source: original entry ↗
More from ZITADEL
Follow ZITADEL to get its new changes in your feed and email digest.
Query limits enforced and restored on list endpoints
ZITADEL 4.19.5 restores and enforces query limits on v1 and v2 API list endpoints, prevents loading all projects on console startup, improves sign verification with server secrets, and requires consent for device authorizations.
v4.19.4 Bug Fixes
This release includes bug fixes for the async execution worker context not having the instance ID set, corrects the ID order in the invite code notification handler, and improves handling of finalized unique-constraint backfill and exclusive owner deletes.
Performance improvements for user queries
Improved performance of user listing queries by indexing users by instance and organization, and stopped expanding login names for every ListUsers row to reduce database load.