v4.11.0
commaai/openpilotv4.11.0Sep 26, 2026by github-actions[bot]
Upgrading?
AI Summary
Security release that hardens various security checks including MFA, OAuth, DCR, password reset, and consent flows, and blocks cross-org API permission fallbacks.
Key Highlights
- Hardened MFA, OAuth, CAS, and signup security checks
- Hardened DCR, session rotation, Kerberos realm, and XSS sinks
- Restricts ID verification providers to their own organization
- Blocks cross-org API permission fallback on empty owner
New Features
- Security hardening for authentication flows
- SSRF and payment notification protections
Full Release Notes
## Changelog ### Bug fixes * 1278f9dcf4dc6c32c7783e8e2d477686bbe629b9 fix: bind MFA remember to device and block avatar SSRF and forged payment notifies * 617995563e6fcb835c582d644909ff7fd38ec78b fix: block cross-org API permission fallback on empty owner * a0701ad84bd50c5e62fd68807b92923d1991ddac fix: harden DCR, session rotation, Kerberos realm and XSS sinks * 03c6c9aaa2eda5b085ce128ce0d60b34094efbd9 fix: harden OAuth, MFA, CAS and signup security checks * a8f8d5652bec12edf36d9f5f232aae1e8beec715 fix: harden consent, password reset, master code and CAS checks * 8b6360ba95df4119a715bbebfd4a700aa4793c78 fix: restrict ID verification and intranet scan providers to their own organization * 34eec9034f34ca25449e0e3b4683ce98f3faf088 fix: validate order plans and payment providers and block tenant SSRF
Related Repositories
public-apis/public-apis★ 491,192
A collective list of free APIs
NousResearch/hermes-agent★ 256,048
The agent that grows with you
yt-dlp/yt-dlp★ 200,220
A feature-rich command-line audio/video downloader
microsoft/markitdown★ 191,542
Python tool for converting files and office documents to Markdown.
Significant-Gravitas/AutoGPT★ 187,700
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.