Repository navigation

Issues

New issue

Proxy outpost (Rust, 2026.8.0) sends duplicate Host header on token backchannel — nginx rejects with 400, forward auth loops (ERR_TOO_MANY_REDIRECTS)
#25226 · przwr opened on Aug 19, 2026
3
Unable to access dashboard or login after upgrade from 2026.5 -> 2026.8
#25559 · HeyItsJono opened on Aug 28, 2026
12

Waiting for email
Bug
goauthentik/authentik#26900 · opened on Oct 14, 2026
SCIM Source: nested PATCH updates are silently ignored due to shallow copy
Bug
goauthentik/authentik#26896 · opened on Oct 13, 2026
Propagate SP-requested ForceAuthn to the upstream source or an MFA step-up
goauthentik/authentik#26894 · opened on Oct 13, 2026
Per-application option to ignore or honor SP-requested ForceAuthn
goauthentik/authentik#26893 · opened on Oct 13, 2026
SCIM provider: deactivate (active: false) instead of deleting users who leave scope
Feature
goauthentik/authentik#26886 · opened on Oct 13, 2026
1
Assigned Role Object Permission should apply to Group children also
Feature
goauthentik/authentik#26882 · opened on Oct 13, 2026
outposts/proxy: envoy forward auth uses Host instead of X-Forwarded-Host since 2026.8.0
goauthentik/authentik#26867 · opened on Oct 13, 2026
non-existent API endpoints could return less HTML
Feature
goauthentik/authentik#26825 · opened on Oct 11, 2026
capture_logs() is not thread-safe: worker permanently stops logging and leaks memory
Bug
goauthentik/authentik#26821 · opened on Oct 11, 2026
Microsoft Entra provider: full sync stops when a group member already exists in Entra (400 "One or more added object references already exist")
Bug
goauthentik/authentik#26817 · opened on Oct 10, 2026
Username is not case sensitive
Bug
goauthentik/authentik#26805 · opened on Oct 9, 2026
Embedded proxy outpost fails with InvalidIssuer when authentik_host is https://localhost
Bug
goauthentik/authentik#26804 · opened on Oct 9, 2026
RAC doesn’t work when authentik runs under a web path (AUTHENTIK_WEB__PATH)
Bug
goauthentik/authentik#26803 · opened on Oct 9, 2026
Add an informal ("du") German translation alongside the existing formal ("Sie") one
Feature
goauthentik/authentik#26794 · opened on Oct 8, 2026
Override Domain key in DUO pushinfo for LDAP outposts
Feature
goauthentik/authentik#26792 · opened on Oct 8, 2026
1
AD group membership writeback
Feature
goauthentik/authentik#26788 · opened on Oct 8, 2026
SPIFFE support
Feature
goauthentik/authentik#26787 · opened on Oct 8, 2026 · Release 2027.2.0: Nice to have
Group binding on an application is evaluated as passing for non-members (policy engine mode ALL, 2025.12.1)
Bug
goauthentik/authentik#26786 · opened on Oct 8, 2026
Pull device compliance data after device association
Task
goauthentik/authentik#26781 · opened on Oct 8, 2026 · Release 2026.11.0: Required
OAuth2 provider Signing Key shows "authentik Self-signed Certificate" when the value is unset
Bug
goauthentik/authentik#26775 · opened on Oct 8, 2026
Token/App password identifier are unique over all users
Feature
goauthentik/authentik#26754 · opened on Oct 7, 2026 · Future release
Authenticator Validation Stage restricted to email accepts TOTP code from disallowed device class
Bug
goauthentik/authentik#26753 · opened on Oct 7, 2026
SCIM does not add user to group when user is created with a group
Bug
goauthentik/authentik#26721 · opened on Oct 5, 2026 · Release 2026.11.0: Nice to have
1
When using ForwardAuth, Basic Authentication and Caddy Authentication header always get's intercepted
Bug
goauthentik/authentik#26711 · opened on Oct 5, 2026
1
Server logs false-positive warn on /health/live/ during startup: client error (Connect) no such file or directory (os error 2)
Bug
goauthentik/authentik#26686 · opened on Oct 4, 2026