version/2025.12.4
goauthentik/authentikversion/2025.12.4Feb 12, 2026by authentik-automation[bot]
Upgrading?
AI Summary
A maintenance release focusing on OAuth2 security fixes, endpoint device documentation, and recovery token transaction handling.
Key Highlights
- Security backports for CVE-2026-25922, CVE-2026-25748, and CVE-2026-25227.
- OAuth2 client secret comparison fix using `compare_digest`.
- Comprehensive updates to endpoint device documentation.
- Recovery token consumption in transactions to prevent race conditions.
New Features
- Email verification scope documentation.
- SSF (SAML Subject Confirmation) documentation updates.
- RAC (Resource Access Control) property mapping formatting fixes.
- Fix for invalid sync_users_password error response.
Full Release Notes
See https://docs.goauthentik.io/docs/releases/2025.12#fixed-in-2025124 ## What's Changed * website/docs: Add changes in 2025.12.2 and 2025.12.3 to the release notes (cherry-pick #19949 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19950 * web/admin: fix default binding order (cherry-pick #19943 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19945 * providers/oauth2: use compare_digest for client_secret comparison (cherry-pick #19979 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19987 * recovery: consume token in transaction (cherry-pick #19967 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19986 * core: bump django from 5.2.10 to 5.2.11 (cherry-pick #19988 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19992 * outposts: fix docker_tls created files permission (cherry-pick #19978 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19993 * website/docs: fix typos (cherry-pick #20000 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20010 * website/docs: endpoint devices: more updates (cherry-pick #19971 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20014 * website/docs: endpoint devices: specify name and slug (cherry-pick #20016 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20025 * website/docs: endpoint devices: fix non debian wording (cherry-pick #20046 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20048 * docs: add instructions for configuring rp-initiated single logout (cherry-pick #20040 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20055 * website: QL Search keyboard interactions docs, examples. (cherry-pick #16259 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20056 * website/docs: automated install: mention no file:// vars (cherry-pick #20043 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20062 * outpost/proxyv2: revalidate auth if session fails to load (cherry-pick #18063 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20059 * website/docs: capturing outpost logs (cherry-pick #20045 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20053 * website/docs: endpoint devices: update device authentication location (cherry-pick #20049 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20051 * website/docs: generate CVE sidebar (cherry-pick #20098 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20101 * sources/oauth: Fix InvalidAudienceError in id_token fallback (cherry-pick #20096 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20122 * website/docs: add email verification scope doc (cherry-pick #20141 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20205 * website/docs: rac: fixes the property mapping formatting (cherry-pick #20200 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20202 * website/docs: ssf: update SSF documentation (cherry-pick #20195 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20210 * security: CVE-2026-25922 (2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20232 * security: CVE-2026-25748 (2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20231 * security: CVE-2026-25227 (2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20230 * web: updated package-lock.json to include missing tree-sitter references (cherry-pick #20244 to version-2025.12) by @rissson in https://github.com/goauthentik/authentik/pull/20245 **Full Changelog**: https://github.com/goauthentik/authentik/compare/version/2025.12.3...version/2025.12.4
Related Repositories
public-apis/public-apis★ 491,218
A collective list of free APIs
NousResearch/hermes-agent★ 256,089
The agent that grows with you
yt-dlp/yt-dlp★ 200,265
A feature-rich command-line audio/video downloader
microsoft/markitdown★ 191,562
Python tool for converting files and office documents to Markdown.
Significant-Gravitas/AutoGPT★ 187,700
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.