New Ory Agent Security is now live! Claim your complimentary test drive. Get Started!

Skip to main content

v26.4.9

v26.4.9​

Cleaner SBOM and CBOM attestations for OEL images​

The SBOM attestations of OEL images now list the license of each Go module. They no longer list the timezone database, shell profile and license text files of the base image, the source repository metadata of the scanner, or secret-pattern matches that are not cryptographic assets. Each document is validated against its schema before it is signed. Tools that ingest the attestations need no changes.

Code emails let email clients autofill the code​

Login, registration, recovery, and verification code emails sent over SMTP now include an OTP-Token header, as proposed in draft-goto-otp-token. The header carries the code and the origin of the site that requested it, for example OTP-Token: "123456"; origin="https://auth.example.com". Email clients that support the header can offer to fill in the code on that site. Emails sent through the HTTP delivery strategy are unchanged.

Compromised eMudhra roots removed from the trust store and container images​

The root certificates compiled into Ory Hydra, Ory Kratos, Ory Keto, and Ory Talos no longer include "emSign ECC Root CA - G3" and "Comodo AAA Services root", the roots distrusted after the eMudhra intermediate CA compromise. The binaries verify outbound TLS connections against this compiled-in root set, so this is the change that removes trust in those roots.

The Ory Enterprise License and open source container images are now also built on gcr.io/distroless/static-debian13, whose ca-certificates 20250419+deb13u1 package no longer ships either root (Debian advisory DSA-6572-1).

Resent emails keep their Message-ID​

Every email that Ory Kratos Identities sends over SMTP now carries a Message-ID header built from the message ID and the domain of courier.smtp.from_address. When an email is sent again, for example after a delivery whose outcome could not be recorded, it carries the same Message-ID. Mailbox providers can then recognize the copy, so recipients usually don't receive the email twice.

Ory Kratos Identities ignores a Message-ID set in courier.smtp.headers, because a configured value would be the same for every email.

Run a web hook when a login attempt fails​

The new selfservice.flows.login.failure.hooks trigger calls a web hook in the background each time Ory Kratos Identities rejects a login attempt's credentials, for example a wrong password or a rejected social sign-in. Use it to report failed logins to a fraud detection service. The web hook gets ctx.failure with the authentication method, the submitted identifier, and the matched identity ID, together with the request's transient_payload. It can't change the response to the user.

SCIM group writes return a conflict when another request is changing the group​

PUT /Groups/{id} and PATCH /Groups/{id} now return 409 Conflict right away when another request is changing the same group. Before, the request waited for the other one to finish and often failed with 500 Internal Server Error after up to 25 seconds.

They also return 409 Conflict when another request changed the group after this one read it. Before, the later request could succeed and silently undo the other request's change, for example removing a member that the other request had just added.

The 409 response carries a Retry-After header. Retry the request after that many seconds. To avoid the error, send writes to one group one at a time.