New Ory Agent Security is now live! Claim your complimentary test drive. Get Started!

Skip to main content

v26.4.1

v26.4.1​

Require positive token cache lifetimes for client credentials​

The oauth2_client_credentials authenticator now rejects zero-duration cache.ttl values. This fixes a security issue where a zero-duration TTL allowed cached authentication results to remain usable beyond token expiry.

Tokens without an expiry are now cached for the configured positive TTL.

Breaking changes​

If you configured a zero-duration TTL, remove cache.ttl to use the token expiry, set a positive duration to limit the cache lifetime, or set cache.enabled to false and remove cache.ttl to disable caching.

Signatures and SBOM and CBOM attestations for OEL images​

Ory now signs every OEL image and publishes each signature next to its image, on the enterprise registries and on Cloudsmith. All OEL images except the debug variants also carry two signed attestations: a Software Bill of Materials in SPDX format, and a CycloneDX document with the Software Bill of Materials and the Cryptography Bill of Materials.