All issues

organization: `create-role` and `update-role` accept a comma in the role name, persisting a role that can never be assigned

#11303

· karuppusamy-d opened

on Sep 16, 2026

phone-number plugin stores the OTP in clear; no storeOTP option as email-otp has

#11297

· delalainOli opened

on Sep 15, 2026

sso: SAML ACS from samlConfig.callbackUrl never reaches expectedRecipients (binding URN passed where samlify expects "post")

#11296

· YehudaBriskman opened

on Sep 15, 2026

The model "oauthResource" was not found in the schema object

#11294

· AdamJSoftware opened

on Sep 15, 2026

twoFactor: the challenge never fires on passwordless sign-in (magic-link / email-otp) and the matcher is not configurable

#11287

· jeremyvinec opened

on Sep 14, 2026

Client rejects with `TypeError: Failed to fetch` on network failure

#11284

· Itz-Agasta opened

on Sep 14, 2026

Allow `customSession` to hide session data from client API without altering server-side `getSession()` for security reason

#11282

· zsh opened

on Sep 14, 2026

`oauth-provider`: `redirect_uri` host is rewritten `127.0.0.1` → `localhost`, breaking the token exchange for loopback clients that use the IP form

#11278

· daniel-1978 opened

on Sep 13, 2026

oauth-provider: no opt-out for HTTPS-only redirect URIs breaks self-hosted HTTP deployments

#11277

· IgnisDa opened

on Sep 13, 2026

organization.acceptInvitation never refreshes the session cookie after the active-organization write, leaving the cookie cache stale

#11275

· manosbatsis opened

on Sep 13, 2026

1.7.3 silently dropped the issuer stamp on account creation — new sign-ups 500 for consumers with a required Account.issuer column

#11274

· manosbatsis opened

on Sep 13, 2026

oauth-provider: extension grants cannot assert acr/auth_time, blocking RFC 8693 token exchange

#11267

· johan-afs opened

on Sep 12, 2026

Promo