version/2026.2.3
goauthentik/authentikversion/2026.2.3May 12, 2026by authentik-automation[bot]
Upgrading?
AI Summary
A patch release focusing on bug fixes, performance optimizations, and security patches for the 2026.2 branch, including Django version bumps and OAuth2 improvements.
Key Highlights
- Security backports for CVE-2026-40166, CVE-2026-40165, CVE-2026-40172, CVE-2026-41569, CVE-2026-41577, CVE-2026-42849, and GHSA-973w-j457-rp2m.
- Django version bump to 5.2.14.
- OAuth2 improvements including federated token introspection and device authorization scope clipping.
- Fixes for LDAP and Radius providers.
New Features
- Continuous login flow improvements.
- Reworked SFE (Server Side Rendering) in web packages.
- RBAC migration fixes ensuring correct execution order.
- Fix for search for app entitlements failing.
Full Release Notes
See https://docs.goauthentik.io/docs/releases/2026.2#fixed-in-202623 ## What's Changed * core: bump django from v5.2.12 to 5.2.13 (cherry-pick #21520 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21526 * endpoints: fix tasks failing (cherry-pick #20904 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21538 * website/docs: add another sentence to First Steps about restricting access to apps (cherry-pick #21517 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21542 * lib/sync/outgoing: avoid expensive query to get number of sync pages (cherry-pick #21575 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21581 * packages/django-dramatiq-postgres: reset db connections in raise_connection_error (cherry-pick #21577 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21599 * providers/oauth2: fix time logic in refresh_token_threshold (cherry-pick #21537 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21598 * blueprints: fix reconcile calling @property (cherry-pick #21576 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21616 * website/docs: add a single page about our user interface, document Consent stage (cherry-pick #20533 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21619 * website/docs: remove broken version tag from oauth doc (cherry-pick #21628 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21629 * web/flows: prevent leader tab deadlock in continuous login flow (cherry-pick #21583 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21627 * providers/oauth2: allow cross provider token introspection for federated providers (cherry-pick #21513 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21748 * providers/oauth2: don't auto-set redirect_uri (cherry-pick #21746 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21750 * ci: fix postgres path for postgres 18 tests (2026.2) (#21767) by @BeryJu in https://github.com/goauthentik/authentik/pull/21789 * website/docs: add authorization header info to all proxy configs (cherry-pick #21664 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21786 * providers/oauth2: clip device authorization scope against the provider's ScopeMapping set (cherry-pick #21701 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21799 * website/docs: improve social login docs titles (cherry-pick #21816 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21818 * providers/radius: fix message authenticator validation (cherry-pick #21824 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21828 * web/packages: Rework SFE rendering (cherry-pick #21833 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21850 * core: fix search for app entitlements failing (cherry-pick #21944 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/21988 * rbac: ensure migration 0056 runs before 0010 removes group field (cherry-pick #21964 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22033 * root: update django to 5.2.14 (cherry-pick #22064 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22066 * packages/django-dramatiq-postgres/broker: avoid task processing stopping on decode error (cherry-pick #22110 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22127 * tenants/settings: present unset flags as `False` (cherry-pick #22162 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22164 * events: fix `destination_group_obj` not being nullable (cherry-pick #22161 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22165 * internal: fix lint by @gergosimonyi in https://github.com/goauthentik/authentik/pull/22263 * internal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2026.2 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22289 * internal: Automated internal backport: CVE-2026-42849.sec.patch to authentik-2026.2 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22287 * internal: Automated internal backport: CVE-2026-41577.sec.patch to authentik-2026.2 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22286 * internal: Automated internal backport: CVE-2026-41569.sec.patch to authentik-2026.2 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22285 * internal: Automated internal backport: CVE-2026-40172.sec.patch to authentik-2026.2 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22284 * internal: Automated internal backport: CVE-2026-40166.sec.patch to authentik-2026.2 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22283 * internal: Automated internal backport: CVE-2026-40165.sec.patch to authentik-2026.2 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22282 * internal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2026.2 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22288 * website/docs: release notes for 2025.12.5 and 2026.2.3 (cherry-pick #22310 to version-2026.2) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22312 **Full Changelog**: https://github.com/goauthentik/authentik/compare/version/2026.2.3-rc1...version/2026.2.3
Related Repositories
public-apis/public-apis★ 491,218
A collective list of free APIs
NousResearch/hermes-agent★ 256,089
The agent that grows with you
yt-dlp/yt-dlp★ 200,265
A feature-rich command-line audio/video downloader
microsoft/markitdown★ 191,562
Python tool for converting files and office documents to Markdown.
Significant-Gravitas/AutoGPT★ 187,700
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.