Linus Rath 3288589e52 fix: pin resolved IP at connect time to block DNS-rebinding SSRF (GHSA-24w9-8r42-8jwm)

2026-08-26 22:11:06 +02:00

..

impersonate

fix(impersonation): reconcile stale persisted account chip after handoff

2026-07-27 05:20:53 +03:00

oauth/metadata

fix: discover OIDC metadata server-side to avoid CORS failures #382

2026-06-02 00:15:50 +02:00

pair

feat: require re-authentication for device pairing and SSO

2026-06-05 19:23:06 +02:00

reauth/sso/complete

feat: require re-authentication for device pairing and SSO

2026-06-05 19:23:06 +02:00

session

fix: honor cookieSameSite admin config override #284

2026-05-14 21:49:37 +02:00

sso

feat(oauth): add OAUTH_AUTHORIZE_URL to override authorize endpoint

2026-06-19 12:30:23 +02:00

stalwart-context

fix: bind stalwart auth context to credential, not cookie-claimed username

2026-05-18 13:00:40 +02:00

token

fix: refresh TOTP-minted tokens with the default client id when no OAuth client is configured #873

2026-08-20 13:59:57 +02:00

totp-token-exchange

fix: pin resolved IP at connect time to block DNS-rebinding SSRF (GHSA-24w9-8r42-8jwm)

2026-08-26 22:11:06 +02:00