Linus Rath bb80d01ddf fix: keep a pairing re-auth from signing the browser in as another account ...

The step-up for linking a device sends the user to the identity
provider with `prompt=login`. The login route accepted that pending
state too, so a code from the re-auth could be spent there and sign this
browser in as whichever account answered the prompt. It now refuses a
re-auth state; only the pairing route completes one.

The callback page also handles its code once. React's development
double effect ran it twice: the second pass no longer saw the re-auth
flag and raced the pairing route for the single-use code.

2026-09-27 04:14:15 +02:00

..

complete

fix: keep a pairing re-auth from signing the browser in as another account

2026-09-27 04:14:15 +02:00

start

fix: accept oauth endpoints on the configured issuer's own host #1028

2026-09-23 19:26:07 +02:00