# ZITADEL v4.15.2

- Product: ZITADEL (https://whatsnew.fyi/product/zitadel)
- Vendor: ZITADEL
- Date: 2026-06-17
- Version: v4.15.2
- Original notes: https://github.com/zitadel/zitadel/releases/tag/v4.15.2
- Permalink: https://whatsnew.fyi/product/zitadel/releases/v4.15.2

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — Always validate exp and iat claims of JWT IdPs
- **fixed** — Client_id verification during code exchange and refresh token flows
- **fixed** — Connection handling in setup after migration steps 40, 64 and 70
- **fixed** — Allow overwriting resource owner of events in eventstore
- **fixed** — Apply PKCE when building OAuth and OIDC providers
- **fixed** — Manage and validate audience in JWT IdP
- **fixed** — Accept IDP sessions on passkey registration in login
- **fixed** — Load custom font from branding settings and allow in CSP in login
- **fixed** — Remove unnecessary entry from default denylist
- **fixed** — Use protected http client for outgoing connections

##### [4.15.2](https://github.com/zitadel/zitadel/compare/v4.15.1...v4.15.2) (2026-06-17)


###### Bug Fixes

* always validate exp and iat claims of JWT IdPs ([4925fab](https://github.com/zitadel/zitadel/commit/4925fab849d39a88674485d937b79e54318b48a8))
* client_id verification during code exchange and refresh token flows ([5624030](https://github.com/zitadel/zitadel/commit/562403079a98cf2059cdac11865a45e2f285be71))
* connection handling in setup after migration steps 40, 64 and 70 ([#12293](https://github.com/zitadel/zitadel/issues/12293)) ([c53d977](https://github.com/zitadel/zitadel/commit/c53d9774d4272d3cebeee4131012c20bd77b9dfb))
* **eventstore:** allow overwriting resource owner of events ([#12261](https://github.com/zitadel/zitadel/issues/12261)) ([a939b84](https://github.com/zitadel/zitadel/commit/a939b847d90c3370bd162064e57764b89c01be46))
* **idp:** apply PKCE when building OAuth and OIDC providers ([#12247](https://github.com/zitadel/zitadel/issues/12247)) ([ab7c6c0](https://github.com/zitadel/zitadel/commit/ab7c6c09d3bb34ac3ec18fc9e0c72d810a614263)), closes [#12036](https://github.com/zitadel/zitadel/issues/12036) [#12054](https://github.com/zitadel/zitadel/issues/12054)
* **jwt idp:** manage and validate audience ([999e2bb](https://github.com/zitadel/zitadel/commit/999e2bbc81b56fca693ccc87a863fdfc182b1316))
* **login:** accept IDP sessions on passkey registration ([#12275](https://github.com/zitadel/zitadel/issues/12275)) ([add46e0](https://github.com/zitadel/zitadel/commit/add46e0c8be3dbf014f77f4ca264f832e4ee49b0))
* **login:** load custom font from branding settings and allow in CSP ([#12279](https://github.com/zitadel/zitadel/issues/12279)) ([9f1561d](https://github.com/zitadel/zitadel/commit/9f1561dc8e56419bba816f5f003e96c606c9f5b1)), closes [#11200](https://github.com/zitadel/zitadel/issues/11200)
* remove unnecessary entry from default denylist ([#12294](https://github.com/zitadel/zitadel/issues/12294)) ([1ca1fbd](https://github.com/zitadel/zitadel/commit/1ca1fbdab4aea43aac76e66abeda3dd3238afc84))
* use protected http client for outgoing connections ([b6f7808](https://github.com/zitadel/zitadel/commit/b6f78086913b8d916bce9ab2e049ab0d84f947fd))