v3.4.12

tanchongmin/strictjsonv3.4.12Jun 17, 2026by github-actions[bot]

AI Summary

Focuses on security and stability by enforcing strict validation of JWT claims and client IDs during token exchange and refresh flows. Also improves connection handling after specific migration steps.

Key Highlights

Always validate exp and iat claims of JWT IdPs
Client ID verification during code exchange
Manage and validate audience for JWT IdPs
Guard defaultRedirectUri in OIDC paths

Full Release Notes

## [3.4.12](https://github.com/zitadel/zitadel/compare/v3.4.11...v3.4.12) (2026-06-17)


### Bug Fixes

* always validate exp and iat claims of JWT IdPs ([d1c3aa8](https://github.com/zitadel/zitadel/commit/d1c3aa84af8fcb0f33910ada30b866f4afb551ac))
* client_id verification during code exchange and refresh token flows ([5b1708e](https://github.com/zitadel/zitadel/commit/5b1708e0e650398f0ebc3341714f0798b0118917))
* **jwt idp:** manage and validate audience ([42f629d](https://github.com/zitadel/zitadel/commit/42f629d8c8e63eb0721ece3aac9f88a62d6c04d5))