Starstruk Logo MarkStarstruk

v4.5.0.7

ace-step/ACE-Step-1.5v4.5.0.7Jun 22, 2026by sid-swirl

AI Summary

This release is a security patch addressing critical vulnerabilities in OIDC authentication and Microsoft 365 token handling to prevent privilege escalation and unauthorized credential fallback.

Key Highlights

  • Fixes OIDC privilege escalation by preventing automatic provisioning of superuser and staff accounts.
  • Removes the vulnerability of shared hardcoded passwords associated with OIDC sign-in.
  • Resolves cross-user Microsoft token fallback by strictly scoping M365 token lookups to the requesting user.
  • No schema or dependency changes are required for this upgrade.

New Features

  • Security patch for OIDC privilege escalation (Issue #1941)
  • Security patch for cross-user Microsoft token fallback
  • Removal of shared hardcoded password mechanism

Full Release Notes

SWIRL Community 4.5.0.7 — Security Patch
Fixes [#1941](https://github.com/swirlai/swirl-search/issues/1941):

* OIDC privilege escalation: sign-in no longer provisions superuser/staff accounts, and no longer sets a shared hardcoded password.
* Cross-user Microsoft token fallback: M365 token lookup is now strictly scoped to the requesting user; removed the fallback that could use another user's credentials.

No schema or dependency changes. Upgrade recommended for any deployment using OIDC sign-in or M365 connectors.