Security 3

• Prevent external-IDP account pre-hijack in Login V1 medium

  Hardened the Login V1 flow to prevent account pre-hijacking via external Identity Providers.

  login-v1
• Require authentication before WebAuthn/U2F and TOTP/OTP enrollment medium

  Requires active authentication before users can enroll in WebAuthn/U2F or TOTP/OTP authentication methods.

  mfa
• Use protected http client for org domain HTTP verification medium

  Use a protected HTTP client for organization domain HTTP verification to prevent Server-Side Request Forgery (SSRF) attacks.

  domain-verification

Bug Fixes 2

• Improve random string generation logic and entropy (#12266)

  The GenerateRandomString function, used for OTP and other codes, was refactored to use crypto/rand.Int to eliminate modulo bias and ensure the entire character set is utilized.

  core-library
• Redirect to external IdP after domain discovery regardless of registration policy (#12369, #12021, #12023)

  Ensures that domain discovery correctly redirects users to an external Identity Provider even if the organization's registration policy is set to 'disallow'. Previously, users were incorrectly blocked with a 'user not found' error.

  login-v1 login-v2

Maintenance & Chores 1

• Speed up ListUsers login name equality filters (#12460)

  Optimized ListUsers with LoginName equality filters (equals and equals-ignore-case) on large datasets. The query planner now uses an INNER JOIN on indexed matching subqueries instead of filtering via views, reducing lookup times significantly on large organizations.

  query-service postgres-projections

Contributors 4