Linus Rath f8592bc6b7 fix: accept oauth endpoints on the configured issuer's own host #1028

2026-09-23 19:26:07 +02:00

..

impersonate

fix(impersonation): reconcile stale persisted account chip after handoff

2026-07-27 05:20:53 +03:00

oauth/metadata

fix: discover OIDC metadata server-side to avoid CORS failures #382

2026-06-02 00:15:50 +02:00

pair

fix: reject cross-site requests to /api/auth/* to stop session fixation (GHSA-qvr9-m8cq-7wvg)

2026-09-17 20:01:35 +02:00

reauth/sso/complete

fix: bind a purpose into encrypted payloads (GHSA-cqqx-mjcf-mh55)

2026-09-17 20:16:51 +02:00

session

fix: explain why calendar subscriptions fail with not authenticated #1073

2026-09-23 18:31:27 +02:00

sso

fix: accept oauth endpoints on the configured issuer's own host #1028

2026-09-23 19:26:07 +02:00

stalwart-context

fix: explain why calendar subscriptions fail with not authenticated #1073

2026-09-23 18:31:27 +02:00

token

fix: reject cross-site requests to /api/auth/* to stop session fixation (GHSA-qvr9-m8cq-7wvg)

2026-09-17 20:01:35 +02:00

totp-token-exchange

fix: reject cross-site requests to /api/auth/* to stop session fixation (GHSA-qvr9-m8cq-7wvg)

2026-09-17 20:01:35 +02:00

verify

fix: reject cross-site requests to /api/auth/* to stop session fixation (GHSA-qvr9-m8cq-7wvg)

2026-09-17 20:01:35 +02:00