What changed in ZITADEL from 3 to 4

4.17.2 (2026-08-31)

Bug Fixes

• api: correct caching and relations of well-known app link files (#12634) (21dbb2e), closes #12580 #12497
• api: prevent cross-instance caching of well-known app link files (#12644) (f0329f0), closes #12634 #12634 #12634 #12497
• console: support Zitadel Support IDP (#12619) (c543449), closes #11825 #5127 #12018 #12056 #12371 #12378 #12384 #12394 #12396 #12422 #12469 #12530 #12568
• login: don't prepend base path to absolute IdP URL on login_hint redirect (#12610) (c660049), closes #12431
• login: redirect unknown users to external IdP after domain discovery when enumeration protection is active (#12581) (af3a9b2), closes #12369 #12369
• login: resolve the registration org consistently with the login policy (#12621) (8fb897d)
• login: show account selection after RP-initiated logout (#12638) (e5f526f), closes #12471 #12252
• oidc: allow OrgRoleIDScope downscoping in token exchange (#12563) (60a2195), closes #12312 #12413 #12312 #11869
• security: prevent TOTP reuse (#12616) (20cbfcf), closes /datatracker.ietf.org/doc/html/rfc6238#section-5

4.17.1 (2026-08-14)

Bug Fixes

• block Login V2 auth for users in deactivated organizations (a9311b8)
• command: enforce permission check when issuing passkey enrollment codes (76dd58e)
• login: prevent the browser from requesting OTP codes via returnCode (5f75afb)
• login: require MFA prompt step before 2FA enrollment (db42371)

4.17.0 (2026-08-12)

Bug Fixes

• actions: allow adding raw metadata values via appendMetadataRaw (#12567) (c1b9885), closes #10666 #5526 #10470 #5526
• allow invite codes for users whose auth methods were all removed (#12453) (eb7af25)
• api: accept SetSecuritySettings on /v2/settings/security (#12518) (6e07fb7), closes #12313
• console: change username abort dialog and set email as verified #10803 #12146 (#12155) (8e2dc18)
• database: skip CREATE USER when role exists to avoid password in Postgres logs (#12538) (207f14a), closes #12178
• login: honour login_hint and skip the auto-submit loop in OIDC flow (#12431) (3bb23d2), closes #12346
• login: provide hidden username on password set/change forms (#12490) (e82b845)
• login: resolve unknownContext error on password page caused by inconsistent ignoreUnknownUsernames handling (#12512) (65e50fc)
• login: treat user-verified passkey as fulfilling MFA in session validity check (#12575) (4f3a1dd)

Features

• add api definition to update Zitadel IdP (#12371) (8106304)
• API definition to add new Zitadel providers (#12018) (9996463)
• command layer implementation for AddZitadelProvider (#12020) (a45ac66)
• eventstore: autovacuum tuning for events2 table (#12449) (0011448), closes #12448 #10754 #10260 #8585 #9239
• extend DeleteProvider to include Zitadel IdP (#12396) (29ec5b0)
• extend start/retrieve idp intent for Zitadel provider (#12424) (df97d7d)
• get/list Zitadel IdP (#12394) (825dbf5)
• handle Zitadel provider IdP login via login v1 (#12469) (9173927)
• implement AddZitadelProvider in ManagementService (#12056) (29196dc)
• implement instance-level UpdateZitadelProvider (#12378) (deaa1a3)
• implement UpdateZitadelProvider in ManagementService (#12384) (de87ee0)
• login: hu translations + I18n consistency v2 (#12447) (f60a4d2)
• login: idp userAction oneof (#12433) (b33f2d5), closes #11369
• login: Sign in with Zitadel (#12530) (e1a924b), closes #11824 #5127
• login: synchronize instance roles for Zitadel identity provider (#12568) (929cfc1), closes #5127
• native app links for passkeys (#12580) (da16af1), closes #12497 #12531 #12532 #12536 #12537 #12547
• oidc: add RFC 7591 dynamic client registration (#12313) (6a02b7e), closes #9810 #12315 #12316 /github.com/zitadel/zitadel/issues/9810#issuecomment-4891176997
• oidc: add RFC 7592 dynamic client management (#12315) (443783a), closes #12313 #12313 #9810 #12313 #12313
• oidc: provide actor information in userinfo actions (#12566) (c2a55d2)
• projection layer implementation to add Zitadel provider (#12055) (7a2f331)
• update GetActiveIdentityProviders to return Zitadel in the IdP list (#12422) (8898e08)

4.16.3 (2026-08-07)

Bug Fixes

• telemetry: record route patterns instead of request paths on HTTP metrics (#12557) (beffd5e), closes #9286 #9523 #11435 #12315 #12556 #9286 #9523 #11435

4.16.2 (2026-07-29)

Bug Fixes

• improve random string generation (#12266) (34345ea)
• login: prevent external-IDP account pre-hijack in Login V1 (917ade3)
• login: redirect to external IdP after domain discovery regardless of registration policy (#12369) (c4ba5a1), closes #12021 #12023
• login: require authentication before WebAuthn/U2F and TOTP/OTP enrollment (c20d613)
• use protected http client for org domain HTTP verification (35122e4)

Performance Improvements

• query: speed up ListUsers login name equality filters (#12460) (b3b8da0)

4.16.1 (2026-07-17)

Bug Fixes

• actions: prevent disk access via require (afe1086)
• console: display minimum length in password complexity message (#12419) (cc3812a), closes #12390
• login: keep submit button disabled/loading during password set r… (#12429) (0a355f7), closes #12416
• login: prevent crash on a stale session cookie (#12423) (6030a43), closes #11130

4.16.0 (2026-07-10)

Bug Fixes

• correct scope validation in token exchange (#12312) (02d07e9), closes #12319 #12322 #12319 #12322
• Correctly remove adjacent roles on user grants (dc89900)
• increase performance of ListUser by login name ignore case (#12350) (8fed358)
• login: allow custom protocols for native apps again (#12332) (5b3c10e)
• login: improve contrast of IDP processing message (#12309) (30ad9ab)
• login: improve error handling for user registration (#12338) (fa916e7)
• login: migrate legacy Tailwind v4 opacity utilities and fix checkbox contrast color (#12360) (70850db)
• login: preserve org domain suffix through account chooser navigation (#12304) (3311fb9), closes #12024
• login: Prevent IDP auto-creation failure when name fields are missing (#11070) (ab2e099)
• login: redirect to loginname instead of empty accounts page when org scope filters all sessions (#12346) (f21f95c), closes #11914
• login: use correct requestId with oidc_ prefix in Prompt.LOGIN + loginHint flow (#12376) (57eb145), closes #11946 #11946
• prevent double triggering of verification emails (#11995) (9ae9bf3)

Features

• allow managing invite code in secret generators (#12109) (915586a)
• crypto: FIPS 140-3 compliant build and runtime checks (#12233) (c03d9f4)

4.15.3 (2026-06-22)

Bug Fixes

• added client and scope validation for token exchange (e2886a6)
• ensure external user's email is verified before auto-linking (c97012f)
• login: center text for generic IDP buttons without icons (#12211) (aadc664), closes #12182
• login: guard defaultRedirectUri in OIDC/SAML FailedPrecondition paths (0382659)

4.15.2 (2026-06-17)

Bug Fixes

• always validate exp and iat claims of JWT IdPs (4925fab)
• client_id verification during code exchange and refresh token flows (5624030)
• connection handling in setup after migration steps 40, 64 and 70 (#12293) (c53d977)
• eventstore: allow overwriting resource owner of events (#12261) (a939b84)
• idp: apply PKCE when building OAuth and OIDC providers (#12247) (ab7c6c0), closes #12036 #12054
• jwt idp: manage and validate audience (999e2bb)
• login: accept IDP sessions on passkey registration (#12275) (add46e0)
• login: load custom font from branding settings and allow in CSP (#12279) (9f1561d), closes #11200
• remove unnecessary entry from default denylist (#12294) (1ca1fbd)
• use protected http client for outgoing connections (b6f7808)