# ZITADEL v4.17.2

- Product: ZITADEL (https://whatsnew.fyi/product/zitadel)
- Vendor: ZITADEL
- Date: 2026-08-31
- Version: v4.17.2
- Original notes: https://github.com/zitadel/zitadel/releases/tag/v4.17.2
- Permalink: https://whatsnew.fyi/product/zitadel/releases/v4.17.2

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — Correct caching and relations of well-known app link files
- **fixed** — Prevent cross-instance caching of well-known app link files
- **fixed** — Support Zitadel Support IDP in console
- **fixed** — Don't prepend base path to absolute IdP URL on login_hint redirect
- **fixed** — Redirect unknown users to external IdP after domain discovery when enumeration protection is active
- **fixed** — Resolve the registration org consistently with the login policy
- **fixed** — Show account selection after RP-initiated logout
- **fixed** — Allow OrgRoleIDScope downscoping in token exchange
- **security** — Prevent TOTP reuse

##### [4.17.2](https://github.com/zitadel/zitadel/compare/v4.17.1...v4.17.2) (2026-08-31)


###### Bug Fixes

* **api:** correct caching and relations of well-known app link files ([#12634](https://github.com/zitadel/zitadel/issues/12634)) ([21dbb2e](https://github.com/zitadel/zitadel/commit/21dbb2e8ca8614fbd1b4555401e16521e7e489ef)), closes [#12580](https://github.com/zitadel/zitadel/issues/12580) [#12497](https://github.com/zitadel/zitadel/issues/12497)
* **api:** prevent cross-instance caching of well-known app link files ([#12644](https://github.com/zitadel/zitadel/issues/12644)) ([f0329f0](https://github.com/zitadel/zitadel/commit/f0329f0298f2d8e141f147b990034080a20d0d71)), closes [#12634](https://github.com/zitadel/zitadel/issues/12634) [#12634](https://github.com/zitadel/zitadel/issues/12634) [#12634](https://github.com/zitadel/zitadel/issues/12634) [#12497](https://github.com/zitadel/zitadel/issues/12497)
* **console:** support Zitadel Support IDP ([#12619](https://github.com/zitadel/zitadel/issues/12619)) ([c543449](https://github.com/zitadel/zitadel/commit/c543449e0f7946f3abbec9fe91c32beeb6b93d30)), closes [#11825](https://github.com/zitadel/zitadel/issues/11825) [#5127](https://github.com/zitadel/zitadel/issues/5127) [#12018](https://github.com/zitadel/zitadel/issues/12018) [#12056](https://github.com/zitadel/zitadel/issues/12056) [#12371](https://github.com/zitadel/zitadel/issues/12371) [#12378](https://github.com/zitadel/zitadel/issues/12378) [#12384](https://github.com/zitadel/zitadel/issues/12384) [#12394](https://github.com/zitadel/zitadel/issues/12394) [#12396](https://github.com/zitadel/zitadel/issues/12396) [#12422](https://github.com/zitadel/zitadel/issues/12422) [#12469](https://github.com/zitadel/zitadel/issues/12469) [#12530](https://github.com/zitadel/zitadel/issues/12530) [#12568](https://github.com/zitadel/zitadel/issues/12568)
* **login:** don't prepend base path to absolute IdP URL on login_hint redirect ([#12610](https://github.com/zitadel/zitadel/issues/12610)) ([c660049](https://github.com/zitadel/zitadel/commit/c660049de4cfa510cb2432c1c81944b8e42ebb60)), closes [#12431](https://github.com/zitadel/zitadel/issues/12431)
* **login:** redirect unknown users to external IdP after domain discovery when enumeration protection is active ([#12581](https://github.com/zitadel/zitadel/issues/12581)) ([af3a9b2](https://github.com/zitadel/zitadel/commit/af3a9b2baef04369df11a4e440c4e565f06f4cf6)), closes [#12369](https://github.com/zitadel/zitadel/issues/12369) [#12369](https://github.com/zitadel/zitadel/issues/12369)
* **login:** resolve the registration org consistently with the login policy ([#12621](https://github.com/zitadel/zitadel/issues/12621)) ([8fb897d](https://github.com/zitadel/zitadel/commit/8fb897d8c8cd96e6b10ca46829f072d70e099696))
* **login:** show account selection after RP-initiated logout ([#12638](https://github.com/zitadel/zitadel/issues/12638)) ([e5f526f](https://github.com/zitadel/zitadel/commit/e5f526fc8e3a440e3371e4802a6cba637690392e)), closes [#12471](https://github.com/zitadel/zitadel/issues/12471) [#12252](https://github.com/zitadel/zitadel/issues/12252)
* **oidc:** allow OrgRoleIDScope downscoping in token exchange ([#12563](https://github.com/zitadel/zitadel/issues/12563)) ([60a2195](https://github.com/zitadel/zitadel/commit/60a2195f458c11f19b48792567ecde7b65c14880)), closes [#12312](https://github.com/zitadel/zitadel/issues/12312) [#12413](https://github.com/zitadel/zitadel/issues/12413) [#12312](https://github.com/zitadel/zitadel/issues/12312) [#11869](https://github.com/zitadel/zitadel/issues/11869)
* **security:** prevent TOTP reuse ([#12616](https://github.com/zitadel/zitadel/issues/12616)) ([20cbfcf](https://github.com/zitadel/zitadel/commit/20cbfcf552b517f4e20cd8c7eea65d5ecd85fe05)), closes [/datatracker.ietf.org/doc/html/rfc6238#section-5](https://github.com//datatracker.ietf.org/doc/html/rfc6238/issues/section-5)