4.20.0 (2026-10-22)

⚠️ Upgrade notes

• Go 1.26: ZITADEL is now built with Go 1.26.10. Outbound TLS connections (SMTP, external IdPs, Actions and webhook targets, HTTP SMS providers) no longer accept certificate chains through the compromised eMudhra intermediate CAs (#12969); affected endpoints need a new certificate, the check can't be disabled. Go 1.26 also rejects URLs with invalid colons in the host and offers post-quantum hybrid key exchanges in TLS by default. If a configured URL or outbound connection stops working, GODEBUG=urlstrictcolons=0 or GODEBUG=tlssecpmlkem=0 restores the previous behavior.
• Login V2: the device code check is now signed with ZITADEL_SESSION_COOKIE_SECRET, like the other login proofs. Users in the middle of a device authorization during the upgrade have to enter the user code again.

Bug Fixes

• console: derive environment.json api from the requested origin (#12893) (e01ccc9), closes #12009 #12195
• deps: build with Go 1.26.10 and golang.org/x/net v0.60.0 (#12932) (3fe639d), closes #12969 #12969

Features

• login: configurable text if external user can neither be create… (#12724) (fb4bc84), closes #12723

Performance Improvements

• query: skip empty login-name pattern SubSelect (#12927) (f8ddee1)

4.19.5 (2026-10-15)

⚠️ Upgrade notes

• Device authorization: users now confirm the device on a consent screen. If a project requires a grant to authenticate, users without one can no longer sign in through the device flow. Custom login UIs need the session.read permission for GetDeviceAuthorizationRequest.
• Login V2: email and invite verification, passkey registration and IdP linking are now also protected by ZITADEL_SESSION_COOKIE_SECRET. If you use a value from an example configuration (e.g. SessionCookieSecretNeedsAtLeast32Chars from the compose .env.example), replace it with a random one. Users in the middle of one of these steps during the upgrade have to repeat it.
• List limits: list endpoints now enforce the default and maximum query limits (A10018).

Bug Fixes

• api: enforce query limits on v2 list endpoints (#12875) (247d8ce), closes zitadel/zitadel#12881 zitadel/zitadel#12876
• api: restore query limits on v1 list endpoints (#12876) (fe4f4fd), closes zitadel/zitadel#12875 #2342 #2433 #2383 #2612 #2820 #2818 #2838 #3075 #3096 zitadel/zitadel#12881 zitadel/zitadel#12875
• console: don't load all projects on startup and prepare for list limits (#12881) (95dae90), closes zitadel/zitadel#12875 zitadel/zitadel#12876 #12875 #12875 #12876 #12876
• login: sign user verification check and IdP link proof with server secret (e32ba7a)
• reject invalid public host headers instead of ignoring them (6493aa9)
• require consent and authorization to approve device authorizations (a618740)

4.19.4 (2026-10-01)

Bug Fixes

• actions: set instance ID in async execution worker context (#12730) (03a2469), closes #11985
• notification: correct ID order of the invite code sent handler (#12846) (101343a)
• skip finalized unique-constraint backfill and exclusive owner deletes (#12833) (aee8b88), closes #12831 #12834

4.19.3 (2026-09-29)

Performance Improvements

• query: index users14 by instance and org (#12830) (d378dea), closes #12826
• query: stop expanding login names for every ListUsers row (#12826) (2c6acd8), closes #10037 #10840 #11768 #12830

This release fixes three security vulnerabilities. We recommend all 4.x deployments upgrade.

Security

• GHSA-x4c7-fpcx-w9q6 (high): SAML identity-provider confusion leading to account takeover
• GHSA-jh92-5mrj-p2w2 (high): account takeover through the unsigned Login V2 session cookie
• GHSA-w4gv-rcwj-w6r5 (low): end-user impersonators could impersonate administrators

⚠️ Upgrade notes for the Login UI (Login V2)

Login V2 now signs its session cookie. Before or while upgrading:

• Set ZITADEL_SESSION_COOKIE_SECRET on the Login UI, for example openssl rand -base64 32. It must be at least 32 characters and the same on all replicas. A shorter value makes the Login UI report not ready. A comma-separated list allows rotating the secret without signing users out.
• Without the secret the Login UI keeps working: it derives the signing key from its API credential and logs a deprecation warning at startup. Rotating that credential then signs all users out of the Login UI.
• Users sign in once more: existing cookies carry no signature and are ignored, so users have to sign in to the Login UI again after the upgrade, possibly more than once during a rolling deployment. Application sessions and issued tokens are not affected.

The Docker Compose deployment now sets the secret through LOGIN_SESSION_COOKIE_SECRET. Login V1 is not affected. See Session cookie signing for details, including how to rotate the secret.

4.19.2 (2026-09-28)

Bug Fixes

• idp: reject SAML assertions from a different IdP than the intent (450c056)
• login: sign session cookie entries (6e4a3d4)
• oidc: require admin.impersonation to impersonate administrators (2c37c41)

Performance Improvements

• eventstore: order by sort key as column list instead of row constructor (#12792) (f1891b8), closes #12703 #12789 #12703 #12790 #12789
• eventstore: order events API by creation date (#12789) (76cd246), closes #10626 #12703 #12703 #12703 #12703 #10626
• eventstore: read projection events per event type (#12753) (3a1b76e), closes #12703 #10626 #12703

4.19.1 (2026-09-23)

Bug Fixes

• setup step 79 batch unique constraint owner backfill (#12803) (42cdd5d)

4.19.0 (2026-09-23)

Bug Fixes

• eventstore: omit owners on empty unique constraint inserts (#12785) (6308539), closes #12740 #12780 #12740

Features

• eventstore: remove application constraints by app owner (#12798) (765027e)

⚠️ Please skip this release and use v4.19.0. The setup step fails in this version (issue).

4.18.0 (2026-09-21)

Bug Fixes

• eventstore: add owners to unique constraints (#12740) (c397a60)
• eventstore: prevent projections from skipping events (#12703) (d49a665), closes #8509 #10480 #10560 #10710
• login: forward login_hint to the external IdP (#12760) (482ddc7), closes #6899 #11552 #12080 #12683
• login: verify API credentials at startup instead of in readiness probe (#12742) (473b0fc)

Features

• database: publish pgxpool pool stats as metrics (#12737) (ff7b399)
• telemetry: auto detect google attributes (#12694) (8195a58)

Performance Improvements

• query: use UNION of index seeks for ListUsers login equality (#12701) (c0b17e0), closes #12460

4.17.3 (2026-09-04)

Bug Fixes

• crypto: use authenticated encryption for IDP intent tokens (41b1114)
• login: authorize IDP linking via enrollment guard, not isSessionValid (a53fbc4)
• login: translate authentication and OTP strings (#12668) (739e91e), closes #12481 #12226
• security: check auth method permission on the user's organization (20f0984)

4.17.2 (2026-08-31)

Bug Fixes

• api: correct caching and relations of well-known app link files (#12634) (21dbb2e), closes #12580 #12497
• api: prevent cross-instance caching of well-known app link files (#12644) (f0329f0), closes #12634 #12634 #12634 #12497
• console: support Zitadel Support IDP (#12619) (c543449), closes #11825 #5127 #12018 #12056 #12371 #12378 #12384 #12394 #12396 #12422 #12469 #12530 #12568
• login: don't prepend base path to absolute IdP URL on login_hint redirect (#12610) (c660049), closes #12431
• login: redirect unknown users to external IdP after domain discovery when enumeration protection is active (#12581) (af3a9b2), closes #12369 #12369
• login: resolve the registration org consistently with the login policy (#12621) (8fb897d)
• login: show account selection after RP-initiated logout (#12638) (e5f526f), closes #12471 #12252
• oidc: allow OrgRoleIDScope downscoping in token exchange (#12563) (60a2195), closes #12312 #12413 #12312 #11869
• security: prevent TOTP reuse (#12616) (20cbfcf), closes /datatracker.ietf.org/doc/html/rfc6238#section-5