Skip to content

v1.31.3

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Aug 00:48
v1.31.3
4769485

v1.31.3 (2026-08-06)

Important

OIDC login now requires a cryptographically verified ID token. Previously unverified tokens are rejected.

Some setups may stop working if:

  • the IdP signs ID tokens with a symmetric algorithm (HS256 / HS384 / HS512) instead of asymmetric (RS* / ES*)
  • the token iss does not exactly match the issuer from the OIDC discovery document (common with mismatched internal vs public Authentik/Keycloak URLs)
  • the provider does not return an id_token (e.g. openid missing from OIDC_SCOPES)
  • optional OIDC_ALLOWED_EMAILS / OIDC_ALLOWED_SUBJECTS are set and the user's email/sub is not listed

Typical Authentik/Keycloak configs with RSA-signed tokens and matching issuer URLs should continue to work unchanged.

Bug Fixes

  • security: Re-validate notification URLs before send (4aabbc5)

  • security: Verify OIDC ID tokens and add optional identity allowlist (b55269b)

Documentation

  • security: Update README and docker-compose to clarify AGENT_SECRET requirements and usage (3eac9d7)

Detailed Changes: v1.31.2...v1.31.3

Assets 2
Loading