Community Release History
This overview covers the published community release records through 16.1.4. Dates are the GitHub publication dates, in UTC. The table summarizes selected changes; use each release record for the complete list and assets. Early records contain only commit ranges, so their summaries are drawn from the linked source comparisons. Gaps in version numbers reflect the published records and are not filled with inferred releases.
Review the published security advisories alongside the history: a fix in an older release is not a guarantee against subsequent bypasses or newly disclosed vulnerabilities. In particular, later 16.1.x releases extend earlier SSRF, script sandbox, deserialization, and PKCE fixes.
16.x
| Release | Published | Selected changes |
|---|---|---|
2026-10-22 |
Account, session, federation, and device flow security fixes; CTS recovery and WindowsDesktopSSO improvements. |
|
2026-09-18 |
Further security hardening, consent CSRF handling, ScriptingService upgrade repair, and Jakarta JSP fixes. |
|
2026-07-20 |
Security fixes for URL fetching, policy import, scripts, WebAuthn, and LDAP filters; OIDC revocation endpoint discovery. |
|
2026-06-17 |
HttpOnly cookies in XUI, access token modification scripts, acr/amr claims, MCP server, and UI JavaScript SDK. |
|
2026-03-24 |
Fixes CVE-2026-33439 (JATO deserialization); SameSite cookie handling and OpenDJ updates. |
|
2026-02-04 |
Jakarta JSTL update, explicit XML security dependency, secondary-instance Docker tests, and dependency security updates. |
|
2025-12-10 |
Jakarta ESAPI dependency, Fedlet index page repair, and dependency security updates. |
|
2025-11-11 |
Java 11 minimum and Jakarta EE 9 migration; Java 25 support, shaded Bouncy Castle libraries, and OAuth fixes. |
15.x
| Release | Published | Selected changes |
|---|---|---|
2025-09-05 |
SAML IdP cache and resource-limit security fixes; generated authentication module documentation. |
|
2025-08-09 |
JATO class-loading fix, frontend tests in Maven, and dependency security updates. |
|
2025-07-17 |
CORS failures return Bad Request; external OpenDJ Docker integration tests and build improvements. |
|
2025-04-23 |
Drops Oracle Directory Server Enterprise Edition configuration-store support; Java 24 build support and schema-loading changes. |
|
2025-03-19 |
Embedded directory setup and OAuth connection handling fixes; Docker proxy address handling. |
|
2025-02-17 |
Generic push authenticator support and updated Java environment documentation. |
|
2024-12-24 |
Social login provider updates, Mail.ru provider, and OIDC issuer validation changes. |
|
2024-11-25 |
Kerberos JVM export correction, Javadoc publication, and dependency security updates. |
|
2024-10-18 |
OAuth scope refresh and default REST API version fixes; AsciiDoc/Antora documentation and Java 23 build support. |
|
2024-09-09 |
Java 22 support, Docker JRE 21, and publication to the community documentation site. |
|
2024-07-25 |
Fixes CVE-2024-41667 (FreeMarker template injection) and updates dependencies. |
|
2024-07-16 |
Documentation packaging and build fixes; dependency updates. |
|
2024-06-26 |
Restores community documentation sources and their build and publication. |
|
2024-06-06 |
Restores the Version servlet with security fixes and repairs privilege updates. |
|
2024-05-21 |
WebAuthn in XUI, generic OATH authenticator support, and ESIA signing changes. |
14.x
| Release | Published | Selected changes |
|---|---|---|
2024-03-12 |
CORS configuration moves to the console; LDAP/AD binding, lockout duration, cache, and CTS fixes. |
|
2024-01-23 |
JSON stdout audit logging, REST setGroups action, session/cache performance fixes, and LDAP TLS defaults. |
|
2023-12-12 |
Session and identity cache fixes, SAML includeCert handling, and social login redirect repair. |
|
2023-10-31 |
Java 21 support, session constraint fixes, and device code polling improvements. |
|
2023-10-10 |
Session, policy, SDK, and Fedlet fixes; container-aware Docker memory settings and dependency security updates. |
|
2023-07-20 |
SAML verification hardening, session cache and CTS fixes, and ssoadm JAX-RPC repair. |
|
2023-02-21 |
NTLMv2 authentication module and session culler, XUI, and dependency fixes. |
|
2023-01-16 |
Shaded JATO library and separation of session creation from updates. |
|
2022-12-19 |
REST membership management, Cassandra and session/cache improvements, WindowsDesktopSSO fixes, and Docker JRE 17. |
|
2022-06-22 |
WindowsDesktopSSO null-token handling, frontend build fixes, and object identifier comparison repair. |
|
2022-06-03 |
Java compatibility, OIDC STS validation, Cassandra and CTS improvements, and authentication/policy fixes. |
|
2021-07-28 |
CVE-2021-35464 workaround, embedded Cassandra logging, and Docker/build improvements. Source comparison. |
|
2021-06-21 |
Authentication module property cache improvements and Cassandra driver updates. Source comparison. |
|
2021-02-08 |
URL matching correction, Netty dependency conflict fix, and embedded Cassandra updates. Source comparison. |
|
2020-12-30 |
STS JWT key identifiers and session cache improvements. Source comparison. |
|
2020-11-10 |
OIDC checkSession iframe handling, JWT validation fix, and dependency updates. Source comparison. |
|
2020-09-17 |
Reverts session expiry/cache changes from 14.5.2 and repairs release builds. Source comparison. |
|
2020-09-14 |
Expired-session endSession handling, session upgrade fixes, and Rhino/OpenDJ updates. Source comparison. |
|
2020-03-11 |
JWT status claims and compressed debug log rotation. Source comparison. |
|
2019-09-05 |
Authentication locale handling, module deletion fixes, JWKS modulus encoding, and XML security updates. Source comparison. |
|
2019-07-29 |
WebAuthn authentication module and account lockout fixes. Source comparison. |
|
2019-04-30 |
Additional JWT authentication claims and CORS/STS improvements. Source comparison. |
|
2019-03-15 |
Configuration store upgrade fixes and extended STS token claims. Source comparison. |
|
2019-03-11 |
Configuration store upgrade and SecurID fixes; navigation back through an authentication chain. Source comparison. |
|
2019-02-08 |
Cookie domain handling for Tomcat 8.5 and dependency security updates. Source comparison. |
|
2019-01-21 |
Bootstrap keystore restart fixes and dependency updates. Source comparison. |
|
2018-10-26 |
SAML redirect path fixes and default organization DN change. Source comparison. |
|
2018-10-18 |
Wiki maintenance; the tagged comparison contains no additional product change summary. Source comparison. |
|
2018-10-15 |
Jersey dependency update. Source comparison. |
|
2018-09-26 |
Disables a grid filter that caused the script list to fail. Source comparison. |
|
2018-09-21 |
OAuth/social login, ESIA, and script sandbox compatibility fixes. Source comparison. |
|
2018-08-13 |
ssoadm repair and build/test fixes. Source comparison. |
|
2018-08-07 |
Policy editor sorting fixes and ESIA scope handling. Source comparison. |
|
2018-07-24 |
Disabled-XUI redirects and authentication module/policy configuration refresh fixes. Source comparison. |
|
2018-05-27 |
Case-sensitive OAuth client identifiers and OpenDJ updates. Source comparison. |
|
2018-05-21 |
CAPTCHA configuration and IP filtering additions. Source comparison. |
|
2018-05-15 |
Persistent cookie default adjustment and OpenDJ updates. Source comparison. |
|
2018-05-08 |
Docker authentication module enablement and reCAPTCHA configuration fixes. Source comparison. |
|
2018-04-28 |
reCAPTCHA authentication module and persistent cookie enhancements. Source comparison. |
|
2018-04-10 |
OpenDJ updates and cache condition fixes. Source comparison. |
|
2018-03-17 |
Client SDK repair for Java policy agents. Source comparison. |
|
2018-03-16 |
LDAP, policy, and condition cache expiry settings; session constraint performance improvements. Source comparison. |
|
2018-03-14 |
Adds administration tools to Docker. Source comparison. |
|
2018-03-12 |
Docker distribution and packaging fixes. Source comparison. |
|
2018-03-11 |
Community distribution, OpenDJ updates, and session/cache fixes. Source comparison. |
Legacy Release
| Release | Published | Selected changes |
|---|---|---|
2020-02-26 |
Imported legacy release from OpenRock; see the release record for provenance. |
The imported 13.0.0 record was published here in 2020; that date is not the date the original upstream version was released. Historical entries do not define current support or an upgrade path. Follow Requirements and Upgrade Considerations before changing an installation.