Search results

feat(login): opt-in application-layer password encryption for regulated / VAPT-compliant deployments

Status: Open.

#12282 In zitadel/zitadel;

· akpradheeph opened on Jun 13, 2026

feat(login): opt-in application-layer password encryption for regulated / VAPT-compliant deployments

Status: Open.

#12281 In zitadel/zitadel;

· akpradheeph opened on Jun 13, 2026

[Bug]: Null byte in client_id at OAuth token endpoint causes HTTP 500 ("Errors.Internal") instead of invalid_client

bugSomething isn't workingSomething isn't working

Status: Open.

Bug

#12278 In zitadel/zitadel;

· Allen-wick opened on Jun 11, 2026

PKCE Enforcement per OAuth2.1

enhancementNew feature or requestNew feature or request

Status: Open.

Enhancement

#12277 In zitadel/zitadel;

· grvijayan opened on Jun 11, 2026

Login v2 session cookie is always Secure — SSO broken on plain-HTTP deployments even with ExternalSecure: false

Status: Open.

#12274 In zitadel/zitadel;

· Alister-uz opened on Jun 11, 2026

[Bug]: Login V2 password-manager compatibility: set-password form has no username field (1Password saves the OTP code as username), invalid autocomplete="password" token, login name not type=email

Status: Open.

#12273 In zitadel/zitadel;

· briknow opened on Jun 10, 2026

[Bug]: Login V2 serves no favicon (no link tags, favicon.ico 404, branding icon unused)

Status: Open.

#12272 In zitadel/zitadel;

· briknow opened on Jun 10, 2026

[Bug]: Login V2 shows language switcher even when only one language is allowed

Status: Open.

#12271 In zitadel/zitadel;

· briknow opened on Jun 10, 2026

ORG_USER_MANAGER should allow managing user credentials/MFA factors, or provide a least-privilege role for this

enhancementNew feature or requestNew feature or request

Status: Open.

Enhancement

#12270 In zitadel/zitadel;

· matiasracedo opened on Jun 10, 2026

Login V2: prompt=create does not forward login_hint to the register page

Status: Open.

#12268 In zitadel/zitadel;

· briknow opened on Jun 10, 2026

Brokered OIDC auto-creation fails when upstream IdP omits preferred_username / given_name / family_name

Status: Open.

#12265 In zitadel/zitadel;

· brightsparc opened on Jun 9, 2026

[Bug]: OIDC max_age parameter is silently ignored during V2 Session Linking

bugSomething isn't workingSomething isn't working

Status: Open.

Bug

#12258 In zitadel/zitadel;

· Allen-wick opened on Jun 9, 2026