New Ory Agent Security is now live! Claim your complimentary test drive. Get Started!

Skip to main content

v26.4.6

v26.4.6​

UAE PASS sign-in uses UUID​

Ory uses the UUID returned by UAE PASS to identify linked accounts on subsequent sign-ins. Jsonnet now receives the UUID as claims.sub; the upstream sub remains available as claims.raw_claims.sub.

Breaking changes​

UAE PASS must return a non-empty UUID for registration, account linking, and sign-in. Existing connections keyed by the upstream sub require migration or relinking before this change is enabled.

Built with Go 1.27.3 to fix CVE-2026-111943​

Ory Kratos Identities, Ory Hydra Authorization, Ory Keto Permissions, Ory Oathkeeper IAM Proxy, and Ory Talos Secure API Keys are now built with Go 1.27.3. This Go release fixes CVE-2026-111943 in the Go standard library.

Certificate verification now rejects certificates issued through a known set of compromised intermediate certificate authorities, even if the system trust store still contains them. This covers every TLS connection the services verify, such as webhooks, OpenID Connect discovery, and databases. A connection to a server that presents such a certificate now fails. Replace those certificates with ones from a trusted issuer.

Throttle failed sign-in attempts per identifier and IP​

When enabled, Ory Identities slows down repeated failed sign-in attempts per submitted identifier and per client IP, with a delay that doubles after each further failure. There is no account lockout, because every delay is capped at a configured maximum. Configure it under selfservice.flows.login.brute_force_protection.