version/2025.12.1

goauthentik/authentikversion/2025.12.1Jan 16, 2026by authentik-automation[bot]

Upgrading?

AI Summary

This patch release for 2025.12 introduces property mapping overrides for OAuth2 scope claims and improves the behavior of endpoint agents. It also resolves theming issues caused by deprecated theme names and fixes UI elements in the admin interface.

Key Highlights

  • Allow property mappings to override scope claim in access tokens
  • Fixed endpoint agent skipping the stage on device IA
  • Fixed deprecated theme names breaking theming
  • Fixed switches in the admin interface
  • Fixed Z-Index and Mobile Sidebar Behavior

New Features

  • Allow property mappings to override scope claim in access tokens

Full Release Notes

See https://docs.goauthentik.io/docs/releases/2025.12#fixed-in-2025121


## What's Changed
* website/docs: remove "beta" tag from 2025.12 (cherry-pick #19404 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19407
* outposts/ldap: fix build by @BeryJu in https://github.com/goauthentik/authentik/pull/19403
* website/docs: add import to discord policy (cherry-pick #19397 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19406
* website/docs: mention dynamic overrides in redirect stage documentation (cherry-pick #19368 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19402
* website/docs: update gws provider docs (cherry-pick #18286 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19400
* web/startup: deprecated theme names break theming (cherry-pick #19431 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19433
* ci: fix checkout stable (for 2025.12) (#19448) by @BeryJu in https://github.com/goauthentik/authentik/pull/19481
* providers/oauth2: allow property mappings to override scope claim in access tokens (cherry-pick #19226 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19480
* core: bump aiohttp from 3.13.2 to v3.13.3 (cherry-pick #19257 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19484
* endpoints/connectors/agent: Skip Endpoint stage on device IA & fix confusing identification subtext (cherry-pick #19482 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19486
* website/docs: limiting permissions of AD service account (cherry-pick #19483 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19489
* endpoints/connectors/agent: add tests for IA endpoint stage (cherry-pick #19487 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19490
* web: Z-Index Fixes, Mobile Sidebar Behavior. (cherry-pick #19460 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19492
* web/admin: fix switches (cherry-pick #19493 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19496


**Full Changelog**: https://github.com/goauthentik/authentik/compare/version/2025.12.0...version/2025.12.1

Related Repositories