New Ory Agent Security is now live! Claim your complimentary test drive. Get Started!

Skip to main content

v26.4.9

v26.4.9​

Cleaner SBOM and CBOM attestations for OEL images​

The SBOM attestations of OEL images now list the license of each Go module. They no longer list the timezone database, shell profile and license text files of the base image, the source repository metadata of the scanner, or secret-pattern matches that are not cryptographic assets. Each document is validated against its schema before it is signed. Tools that ingest the attestations need no changes.

Compromised eMudhra roots removed from the trust store and container images​

The root certificates compiled into Ory Hydra, Ory Kratos, Ory Keto, and Ory Talos no longer include "emSign ECC Root CA - G3" and "Comodo AAA Services root", the roots distrusted after the eMudhra intermediate CA compromise. The binaries verify outbound TLS connections against this compiled-in root set, so this is the change that removes trust in those roots.

The Ory Enterprise License and open source container images are now also built on gcr.io/distroless/static-debian13, whose ca-certificates 20250419+deb13u1 package no longer ships either root (Debian advisory DSA-6572-1).

Reject authorization requests without PKCE before login when PKCE is required​

When PKCE is required for a client, the authorization endpoint now rejects a request for an authorization code that has no code_challenge right away, with the invalid_request error. Before, the user first went through login and consent, and the request failed afterwards.

The discovery documents (/.well-known/openid-configuration and /.well-known/oauth-authorization-server) now list only S256 in code_challenge_methods_supported. They listed plain before, but the authorization endpoint never accepted it.