v4.17.1

zitadel/zitadelv4.17.1Aug 14, 2026by github-actions[bot]

AI Summary

A security-focused release that hardens login flows by blocking access for users in deactivated organizations and enforcing strict permission checks for passkey enrollment codes.

Key Highlights

Block Login V2 for users in deactivated organizations
Enforce permission check when issuing passkey enrollment codes
Prevent OTP code requests via returnCode

Full Release Notes

## [4.17.1](https://github.com/zitadel/zitadel/compare/v4.17.0...v4.17.1) (2026-08-14)


### Bug Fixes

* block Login V2 auth for users in deactivated organizations ([a9311b8](https://github.com/zitadel/zitadel/commit/a9311b8c702531832575351a663e98a2242778e5))
* **command:** enforce permission check when issuing passkey enrollment codes ([76dd58e](https://github.com/zitadel/zitadel/commit/76dd58ecdf3b6fcb9fb321c9ba7d009fcfa345e5))
* **login:** prevent the browser from requesting OTP codes via returnCode ([5f75afb](https://github.com/zitadel/zitadel/commit/5f75afb98c75bf415df0c061563a39fb016f0e22))
* **login:** require MFA prompt step before 2FA enrollment ([db42371](https://github.com/zitadel/zitadel/commit/db4237161c7293d5410e8495765a9b4935bdd7af))