version/2025.12.5
goauthentik/authentikversion/2025.12.5May 12, 2026by authentik-automation[bot]
Upgrading?
AI Summary
A maintenance release featuring documentation updates, CI fixes, and specific improvements to OAuth2, LDAP, and SAML providers for the 2025.12 branch.
Key Highlights
- Updates to release notes for older versions (2025.10.4, 2025.12.4, 2025.8.6).
- Additions of Okta and Wallos integrations.
- OAuth2 fixes for device code flow and redirect URI handling.
- LDAP fixes for exception handling and header writes.
New Features
- Custom CSS support.
- Continuous login flow addition.
- Enterprise license algorithm updates (ES384).
- Fix for LDAP debug endpoint exceptions.
Full Release Notes
See https://docs.goauthentik.io/docs/releases/2025.12#fixed-in-2025125 ## What's Changed * website/docs: 2025.10.4 release notes (cherry-pick #20242 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20250 * website/docs: 2025.12.4 release notes (cherry-pick #20226 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20252 * website/docs: 2025.8.6 release notes (cherry-pick #20243 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20256 * ci: fix binary outpost build on release (cherry-pick #20248 to version-2025.12) by @rissson in https://github.com/goauthentik/authentik/pull/20280 * website/docs: add okta source doc (cherry-pick #20296 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20334 * root: do not rely on npm cli for version bump (cherry-pick #20276 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20320 * ci: fix setup altering package-lock (cherry-pick #20348 to version-2025.12) by @rissson in https://github.com/goauthentik/authentik/pull/20355 * website/docs: Custom CSS (cherry-pick #19991 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20286 * web: Fix locale selector in compatibility mode. (cherry-pick #19946 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20088 * sources/saml: update handling statusmessage (cherry-pick #19739 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20066 * website/docs: Fix broken link to flow executor (cherry-pick #20364 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20369 * ci: pull latest changes before tagging new version (cherry-pick #20413 to version-2025.12) by @rissson in https://github.com/goauthentik/authentik/pull/20415 * website/docs: rac: update rac provider docs (cherry-pick #20225 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20336 * stages/user_login: log correct user when session binding is broken (cherry-pick #20094 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20452 * policies: measure policy process from manager (cherry-pick #20477 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20480 * website/docs: fix GitHub social-login wording and capitalization (cherry-pick #20489 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20504 * enterprise: add `ES384` to enterprise license algorithms (cherry-pick #20507 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20509 * endpoints: fix infinite recursion in stage with unsupported connector (cherry-pick #20485 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20513 * website/docs: fix linux setup docs (cherry-pick #20508 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20516 * providers/oauth2: deactivate locale after testing (cherry-pick #20518 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20525 * policies: fix PolicyEngineMode ALL with static binding optimization (cherry-pick #20430 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20523 * website/docs: remove bad logs redirect (cherry-pick #20522 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20547 * internal: make http timeouts configurable (cherry-pick #20472 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20566 * web/sfe: bug: polyfill needed to supply Object.assign() to IE11. (cherry-pick #20126 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20136 * website/docs: kerberos: add note about caching (cherry-pick #20663 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20665 * providers/proxy: move search path to query instead of runtime parameter (cherry-pick #20662 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20692 * core: bump django from 5.2.11 to 5.2.12 (cherry-pick #20719 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20737 * web/admin: Fix SCIM page_size UI issue (cherry-pick #20890 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20928 * web/flows: add continuous flow 2025.12 by @BeryJu in https://github.com/goauthentik/authentik/pull/20362 * web/admin: fix missing OSM referrerPolicy header (cherry-pick #20984 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20989 * flows: continous login debug 2025.12 by @BeryJu in https://github.com/goauthentik/authentik/pull/21044 * web/admin: handle non-string values in formatUUID to prevent Event Log crash (cherry-pick #20804 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21051 * events: avoid implicitly setting context from login_failed event (cherry-pick #21045 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21049 * docs: Add note on skipping object syncing (cherry-pick #20882 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/20893 * ci: fix escaping in cherry-pick action (#21082) by @BeryJu in https://github.com/goauthentik/authentik/pull/21084 * ci: rotate GH App private key (version-2025.12) by @BeryJu in https://github.com/goauthentik/authentik/pull/21086 * core: bump cbor2 from 5.8.0 to 5.9.0 (cherry-pick #21094 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21095 * sources/ldap: fix exception in ldap debug endpoint (cherry-pick #21219 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21220 * proviers/ldap: avoid concurrent header writes in API Client (cherry-pick #21223 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21227 * website/docs: add example recovery flow with MFA (cherry-pick #19497 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21304 * ci: allow setting working directory for setup action (2025.12) by @BeryJu in https://github.com/goauthentik/authentik/pull/21331 * root: fix compose generation for patch releases release candidates (cherry-pick #21353 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21354 * providers/saml: Fix redirect for saml slo (cherry-pick #21258 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21283 * web/flows: prevent leader tab deadlock in continuous login flow (cherry-pick #21583 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21626 * core: bump django from v5.2.12 to 5.2.13 (cherry-pick #21520 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21525 * providers/oauth2: don't auto-set redirect_uri (cherry-pick #21746 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21749 * providers/oauth2: allow cross provider token introspection for federated providers (cherry-pick #21513 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21747 * ci: fix postgres path for postgres 18 tests (2025.12) (#21767) by @BeryJu in https://github.com/goauthentik/authentik/pull/21788 * providers/oauth2: device code flow client id via auth header (cherry-pick #20457 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21803 * providers/oauth2: clip device authorization scope against the provider's ScopeMapping set (cherry-pick #21701 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21798 * providers/radius: fix message authenticator validation (cherry-pick #21824 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21827 * web/packages: Rework SFE rendering (cherry-pick #21833 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21851 * web: Fix duplicate Turnstile widgets after extended idle (cherry-pick #21380 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21472 * root: update django to 5.2.14 (cherry-pick #22064 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22065 * internal: fix lint (cherry-pick #22263 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22306 * internal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2025.12 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22281 * internal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2025.12 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22280 * internal: Automated internal backport: CVE-2026-41577.sec.patch to authentik-2025.12 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22278 * internal: Automated internal backport: CVE-2026-40172.sec.patch to authentik-2025.12 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22277 * internal: Automated internal backport: CVE-2026-40166.sec.patch to authentik-2025.12 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22276 * internal: Automated internal backport: CVE-2026-40165.sec.patch to authentik-2025.12 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22275 * internal: Automated internal backport: CVE-2026-42849.sec.patch to authentik-2025.12 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22279 * website/docs: release notes for 2025.12.5 and 2026.2.3 (cherry-pick #22310 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22311 **Full Changelog**: https://github.com/goauthentik/authentik/compare/version/2025.12.4...version/2025.12.5
Related Repositories
public-apis/public-apis★ 491,218
A collective list of free APIs
NousResearch/hermes-agent★ 256,089
The agent that grows with you
yt-dlp/yt-dlp★ 200,265
A feature-rich command-line audio/video downloader
microsoft/markitdown★ 191,562
Python tool for converting files and office documents to Markdown.
Significant-Gravitas/AutoGPT★ 187,700
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.