Linus Rath e055ee8201 fix: verify credentials upstream before minting identity cookies (GHSA-wxcm-j4jc-9fxq)

2026-09-17 20:48:42 +02:00

..

impersonate

fix(impersonation): reconcile stale persisted account chip after handoff

2026-07-27 05:20:53 +03:00

oauth/metadata

fix: discover OIDC metadata server-side to avoid CORS failures #382

2026-06-02 00:15:50 +02:00

pair

fix: reject cross-site requests to /api/auth/* to stop session fixation (GHSA-qvr9-m8cq-7wvg)

2026-09-17 20:01:35 +02:00

reauth/sso/complete

fix: bind a purpose into encrypted payloads (GHSA-cqqx-mjcf-mh55)

2026-09-17 20:16:51 +02:00

session

fix: verify credentials upstream before minting identity cookies (GHSA-wxcm-j4jc-9fxq)

2026-09-17 20:48:42 +02:00

sso

fix: bind a purpose into encrypted payloads (GHSA-cqqx-mjcf-mh55)

2026-09-17 20:16:51 +02:00

stalwart-context

fix: verify credentials upstream before minting identity cookies (GHSA-wxcm-j4jc-9fxq)

2026-09-17 20:48:42 +02:00

token

fix: reject cross-site requests to /api/auth/* to stop session fixation (GHSA-qvr9-m8cq-7wvg)

2026-09-17 20:01:35 +02:00

totp-token-exchange

fix: reject cross-site requests to /api/auth/* to stop session fixation (GHSA-qvr9-m8cq-7wvg)

2026-09-17 20:01:35 +02:00

verify

fix: reject cross-site requests to /api/auth/* to stop session fixation (GHSA-qvr9-m8cq-7wvg)

2026-09-17 20:01:35 +02:00