Disclaimer: Automated heuristics over public release notes and vulnerability databases (OSV / NVD). Can be wrong or incomplete. Always back up first and validate upgrades yourself. Stack Watch does not invent CVE IDs or issue counts. This is an MVP research project, not a live paid service.

Home / Authentik / version/2026.8.4

Authentik version/2026.8.4

WAIT

Release notes signal caution: root, web, docs: revert pnpm to 11.20.0 on version-2026.8 (#26366)

Published: 2026-10-14T22:53:11Z · GitHub release

Summary of changes

See https://docs.goauthentik.io/docs/releases/2026.8#fixed-in-202684 ## What Changed in 2026.8.4 - common/saml: Fix metadata to serve only the leaf of a PEM chain (#26273) - core: handle overflow in duration validation (#26680) - endpoints: fix error during device lookup with one identifier missing (#26902) - endpoints: retain last fact snapshot (#26343) - enterprise/requests: show message after successful request (#26587) - events: fix group membership changes with OSS audit middleware (#26477) - flows: allow unauthenticated flows for re-authentication (#26785) - lifecycle: fix AWS cloudformation template defaults (#26807) - outposts/proxy: don't negotiate HTTP/2 to upstreams (#26281) - outposts/proxy: fetch embedded JWKS over the unix socket, not the browser host (#26448) - outposts/proxy: use HTTP/1.1 for OAuth backchannel requests (#26422) …

Breaking changes

None detected by heuristics.

CVEs linked to this release

None linked from release notes or OSV fixed-in match.

Linked issues / PRs mentioned

Back up first

Always back up first. Stack Watch briefs are automated heuristics over public release notes and vulnerability databases. They can be wrong or incomplete. You are responsible for validating upgrades in your own environment. We never invent CVE IDs or issue counts — if a number is missing, it was not found.