v4.16.2

gtsteffaniak/filebrowserv4.16.2Jul 29, 2026by github-actions[bot]

AI Summary

A patch release for Zitadel with security updates and performance optimizations for user queries.

Key Highlights

Improved random string generation for security.
Prevented external-IDP account pre-hijack in Login V1.
Redirected to external IdP after domain discovery.
Speeded up ListUsers login name equality filters.

Full Release Notes

## [4.16.2](https://github.com/zitadel/zitadel/compare/v4.16.1...v4.16.2) (2026-07-29)


### Bug Fixes

* improve random string generation ([#12266](https://github.com/zitadel/zitadel/issues/12266)) ([34345ea](https://github.com/zitadel/zitadel/commit/34345ea8f6d98e7a7db58dac0ba106239caa8876))
* **login:** prevent external-IDP account pre-hijack in Login V1 ([917ade3](https://github.com/zitadel/zitadel/commit/917ade35af9c51e4b57ca8e57488ae95928182ad))
* **login:** redirect to external IdP after domain discovery regardless of registration policy ([#12369](https://github.com/zitadel/zitadel/issues/12369)) ([c4ba5a1](https://github.com/zitadel/zitadel/commit/c4ba5a1da5c56bac33b9f10e5e29fad39f0be05e)), closes [#12021](https://github.com/zitadel/zitadel/issues/12021) [#12023](https://github.com/zitadel/zitadel/issues/12023)
* **login:** require authentication before WebAuthn/U2F and TOTP/OTP enrollment ([c20d613](https://github.com/zitadel/zitadel/commit/c20d6132965654bb761cd9009a5f013be2b5cf68))
* use protected http client for org domain HTTP verification ([35122e4](https://github.com/zitadel/zitadel/commit/35122e43974d542297018c57cc0fffb9db8a64ac))


### Performance Improvements

* **query:** speed up ListUsers login name equality filters ([#12460](https://github.com/zitadel/zitadel/issues/12460)) ([b3b8da0](https://github.com/zitadel/zitadel/commit/b3b8da01b54fd1c698226cc261d7bca17dcd1478))