Kaleta 3.3.4 (security)

Kaleta 3.3.4 is a security release for the sign-in that connects Claude to your site (OAuth). It fixes what our audit of 8 October 2026 found. Installations update to it by themselves.

Claude apps that are already connected keep working. You don't need to do anything.

The approval screen

• Where the app returns: when an app asks to connect, the screen now leads with the address the app returns to.
  • It warns clearly when that address doesn't belong to Claude (claude.ai, claude.com, or your own computer for Claude Code).
  • It marks an app this site has never approved before as new.
  • A look-alike app can no longer pass itself off as Claude: apps on other addresses are called "the application", and Drafts only is selected in advance.
• The request you saw: approving a connection now approves exactly the request you saw. Opening a second request in the meantime can no longer redirect your approval to another app.
• New setting, "Only allow Claude's own apps to connect": under Claude settings. It is off by default. When on, apps on any other address can't register or connect.

Tokens

• Codes and refresh tokens: each sign-in code and each refresh token can now be used only once, even when requests arrive at the same moment.
• Retries: a retry of the same refresh within 30 seconds gets the same new tokens, so a dropped connection doesn't sign Claude out.
• Reuse: a later reuse of an old refresh token is treated as theft. It disconnects that app and records a security event.
• Unused registrations: these are removed after a day. Approved apps are never removed.
• The code verifier: it must have the length the standard requires.

Updating

Sites update by themselves. You can also update from Settings → Backups and updates. The update adds a column and a small table for the sign-in; every app already connected counts as approved.