Repository navigation

Issues

New issue

Proxy outpost (Rust, 2026.8.0) sends duplicate Host header on token backchannel — nginx rejects with 400, forward auth loops (ERR_TOO_MANY_REDIRECTS)
#25226 · przwr opened on Aug 19, 2026
3
Unable to access dashboard or login after upgrade from 2026.5 -> 2026.8
#25559 · HeyItsJono opened on Aug 28, 2026
12

WebAuthn authenticator validate always fails with 'Client data challenge was not expected challenge' on 2026.8.4 (split-screen flow, Bitwarden passkey)
goauthentik/authentik#26986 · opened on Oct 17, 2026
1
Global app_access cache invalidation on every User save causes deadlocks and timeouts under concurrent enrollment
goauthentik/authentik#26981 · opened on Oct 16, 2026
Proxy outpost websocket ignores SSL_CERT_FILE / system trust store since 2026.8 (UnknownIssuer with a private CA)
goauthentik/authentik#26980 · opened on Oct 16, 2026
Occasional "failed to send health live request to server" in monitoring
Bug
goauthentik/authentik#26975 · opened on Oct 16, 2026
Separate task queues for high priority and background
Task
goauthentik/authentik#26958 · opened on Oct 15, 2026 · Release 2027.2.0: Required
RAC: browser client receiveTimeout of 10 s causes "514 Server timeout" disconnects on idle screens
Bug
goauthentik/authentik#26957 · opened on Oct 15, 2026
1
#26353 (leftmost X-Forwarded-For) reintroduces client-IP spoofing; #25811 should be solved via trusted proxy CIDRs
goauthentik/authentik#26941 · opened on Oct 15, 2026
1
Blueprints aren't reapplied when only their !Env or !File values change
goauthentik/authentik#26925 · opened on Oct 14, 2026
Parallel blueprint applies deadlock when they save providers of the same outpost
goauthentik/authentik#26924 · opened on Oct 14, 2026
SCIM ObjectExistsSyncException does not provide context or remediation
Bug
goauthentik/authentik#26904 · opened on Oct 14, 2026
Propagate SP-requested ForceAuthn to the upstream source or an MFA step-up
goauthentik/authentik#26894 · opened on Oct 13, 2026 · Future release
Per-application option to ignore or honor SP-requested ForceAuthn
goauthentik/authentik#26893 · opened on Oct 13, 2026 · Release 2026.11.0: Nice to have
1
SCIM provider: deactivate (active: false) instead of deleting users who leave scope
Feature
goauthentik/authentik#26886 · opened on Oct 13, 2026 · Release 2026.11.0: Nice to have
1
Assigned Role Object Permission should apply to Group children also
Bug
goauthentik/authentik#26882 · opened on Oct 13, 2026
outposts/proxy: envoy forward auth uses Host instead of X-Forwarded-Host since 2026.8.0
goauthentik/authentik#26867 · opened on Oct 13, 2026
non-existent API endpoints could return less HTML
Feature
goauthentik/authentik#26825 · opened on Oct 11, 2026 · Release 2026.11.0: Required
capture_logs() is not thread-safe: worker permanently stops logging and leaks memory
Bug
goauthentik/authentik#26821 · opened on Oct 11, 2026
RAC doesn’t work when authentik runs under a web path (AUTHENTIK_WEB__PATH)
Bug
goauthentik/authentik#26803 · opened on Oct 9, 2026
Add an informal ("du") German translation alongside the existing formal ("Sie") one
Feature
goauthentik/authentik#26794 · opened on Oct 8, 2026
Override Domain key in DUO pushinfo for LDAP outposts
Feature
goauthentik/authentik#26792 · opened on Oct 8, 2026
1
AD group membership writeback
Feature
goauthentik/authentik#26788 · opened on Oct 8, 2026
SPIFFE support
Feature
goauthentik/authentik#26787 · opened on Oct 8, 2026 · Release 2027.2.0: Nice to have
Group binding on an application is evaluated as passing for non-members (policy engine mode ALL, 2025.12.1)
Bug
goauthentik/authentik#26786 · opened on Oct 8, 2026
1
Pull device compliance data after device association
Task
goauthentik/authentik#26781 · opened on Oct 8, 2026 · Release 2026.11.0: Required
OAuth2 provider Signing Key shows "authentik Self-signed Certificate" when the value is unset
Bug
goauthentik/authentik#26775 · opened on Oct 8, 2026

Navigation Menu

Repository navigation

Issues

Issues

WebAuthn authenticator validate always fails with 'Client data challenge was not expected challenge' on 2026.8.4 (split-screen flow, Bitwarden passkey)

Global app_access cache invalidation on every User save causes deadlocks and timeouts under concurrent enrollment

Proxy outpost websocket ignores SSL_CERT_FILE / system trust store since 2026.8 (UnknownIssuer with a private CA)

Occasional "failed to send health live request to server" in monitoring

Separate task queues for high priority and background

RAC: browser client receiveTimeout of 10 s causes "514 Server timeout" disconnects on idle screens

#26353 (leftmost X-Forwarded-For) reintroduces client-IP spoofing; #25811 should be solved via trusted proxy CIDRs

Blueprints aren't reapplied when only their `!Env` or `!File` values change

Parallel blueprint applies deadlock when they save providers of the same outpost

SCIM ObjectExistsSyncException does not provide context or remediation

Propagate SP-requested ForceAuthn to the upstream source or an MFA step-up

Per-application option to ignore or honor SP-requested ForceAuthn

SCIM provider: deactivate (active: false) instead of deleting users who leave scope

Assigned Role Object Permission should apply to Group children also

outposts/proxy: envoy forward auth uses Host instead of X-Forwarded-Host since 2026.8.0

non-existent API endpoints could return less HTML

capture_logs() is not thread-safe: worker permanently stops logging and leaks memory

RAC doesn’t work when authentik runs under a web path (AUTHENTIK_WEB__PATH)

Add an informal ("du") German translation alongside the existing formal ("Sie") one

Override Domain key in DUO pushinfo for LDAP outposts

AD group membership writeback

SPIFFE support

Group binding on an application is evaluated as passing for non-members (policy engine mode ALL, 2025.12.1)

Pull device compliance data after device association

OAuth2 provider Signing Key shows "authentik Self-signed Certificate" when the value is unset