v4.16.2

calcom/cal.diyv4.16.2Jul 29, 2026by github-actions[bot]

AI Summary

This release includes a series of security and login flow fixes, such as improved random string generation, protection against external IDP hijacking, and fixes for domain discovery redirects.

Key Highlights

Improved random string generation
Prevented external-IDP account pre-hijack in Login V1
Redirect to external IdP after domain discovery regardless of registration policy
Required authentication before WebAuthn/U2F and TOTP/OTP enrollment
Used protected HTTP client for org domain HTTP verification

Full Release Notes

## [4.16.2](https://github.com/zitadel/zitadel/compare/v4.16.1...v4.16.2) (2026-07-29)


### Bug Fixes

* improve random string generation ([#12266](https://github.com/zitadel/zitadel/issues/12266)) ([34345ea](https://github.com/zitadel/zitadel/commit/34345ea8f6d98e7a7db58dac0ba106239caa8876))
* **login:** prevent external-IDP account pre-hijack in Login V1 ([917ade3](https://github.com/zitadel/zitadel/commit/917ade35af9c51e4b57ca8e57488ae95928182ad))
* **login:** redirect to external IdP after domain discovery regardless of registration policy ([#12369](https://github.com/zitadel/zitadel/issues/12369)) ([c4ba5a1](https://github.com/zitadel/zitadel/commit/c4ba5a1da5c56bac33b9f10e5e29fad39f0be05e)), closes [#12021](https://github.com/zitadel/zitadel/issues/12021) [#12023](https://github.com/zitadel/zitadel/issues/12023)
* **login:** require authentication before WebAuthn/U2F and TOTP/OTP enrollment ([c20d613](https://github.com/zitadel/zitadel/commit/c20d6132965654bb761cd9009a5f013be2b5cf68))
* use protected http client for org domain HTTP verification ([35122e4](https://github.com/zitadel/zitadel/commit/35122e43974d542297018c57cc0fffb9db8a64ac))


### Performance Improvements

* **query:** speed up ListUsers login name equality filters ([#12460](https://github.com/zitadel/zitadel/issues/12460)) ([b3b8da0](https://github.com/zitadel/zitadel/commit/b3b8da01b54fd1c698226cc261d7bca17dcd1478))