Issues

• Design document: treat user-verified passkey logins as AAL2

  Needs Triage
  ory/kratos#4621 · Filter by author Micaso opened on Oct 19, 2026
  3

• Guest identities: issue a session to a visitor without credentials and keep the identity on sign-up

  feat
  ory/kratos#4617 · Filter by author vinckr opened on Oct 8, 2026
  2

• Remove stale two_step_registration hook injection for profile_first registration

  bug
  ory/kratos#4615 · Filter by author andrinh opened on Sep 29, 2026

• Expired native Login/Registration use_flow_id loses the session-token exchanger

  Needs Triage
  ory/kratos#4610 · Filter by author robingullo opened on Sep 18, 2026

• transient_payload is not propagated to all settings webhooks

  bug
  ory/kratos#4609 · Filter by author icamys opened on Sep 17, 2026

• serve.admin.request_log.disable_for_health has no effect (admin prefix added after the request logger)

  Needs Triage
  ory/kratos#4605 · Filter by author tomers opened on Sep 14, 2026

• Nil-pointer panic in JWT tokenizer when Jsonnet claims mapper returns non-object claims

  ory/kratos#4585 · Filter by author graysoncooper opened on Jul 23, 2026

• Allow updating session information in webhooks

  feat
  ory/kratos#4584 · Filter by author MichaelMarner opened on Jul 23, 2026

• Valid sessions intermittently receive 401s under load

  bug
  ory/kratos#4581 · Filter by author spendres opened on Jul 3, 2026
  1

• Courier service health endpoints

  feat
  ory/kratos#4579 · Filter by author noamcattan opened on Jun 18, 2026

• Dependency: pgx v5.9.2 missing auth downgrade protection (CWE-306, fix in v5.10.0)

  ory/kratos#4576 · Filter by author canolgun opened on Jun 14, 2026

• Dependency: pgx v5.9.2 vulnerable to auth downgrade (CWE-306, fix in v5.10.0)

  ory/kratos#4573 · Filter by author canolgun opened on Jun 12, 2026

• JWKS parsing fails entirely when provider includes ES256K (secp256k1 in Telegram OIDC)

  bug
  ory/kratos#4572 · Filter by author SKozak opened on Jun 12, 2026
  1

• YugabyteDB support

  feat
  ory/kratos#4563 · Filter by author bandogora opened on May 3, 2026

• Security hardening follow-ups from Kratos scan

  ory/kratos#4557 · Filter by author chendingplano opened on Apr 8, 2026

• Support Custom Subject Mapping via Webhook for OAuth2 Flows

  feat
  ory/kratos#4553 · Filter by author tongium opened on Mar 26, 2026

• Passkey ≠ platform attachment

  bug
  ory/kratos#4552 · Filter by author adricasti opened on Mar 25, 2026
  2

• Altcha ("Alternative CAPTCHA") support

  feat
  ory/kratos#4549 · Filter by author fenech opened on Mar 19, 2026

• RequestURL returns incorrect URL behind reverse proxy with stripped path prefixes

  bug
  ory/kratos#4548 · Filter by author markusnissl opened on Mar 12, 2026

• Respect return_to URL in OIDC callback error

  bug
  ory/kratos#4547 · Filter by author renom opened on Mar 12, 2026

• Support validating credentials directly in admin API outside of self-service API

  feat
  ory/kratos#4538 · Filter by author tobias-urdin opened on Feb 20, 2026

• feat: Add use_oidc_discovery_issuer option for generic OIDC provider (Azure AD B2C support)

  ory/kratos#4536 · Filter by author getlarge opened on Feb 11, 2026

• Session Token Rotation

  feat
  ory/kratos#4530 · Filter by author nightloewe1 opened on Jan 23, 2026
  3

• feat: allow using external_id as the subject in OAuth2 login flows

  feat
  ory/kratos#4528 · Filter by author Micaso opened on Jan 23, 2026

• NET Client (NuGet 1.20.11) fails to deserialize sessions with passkey authentication method

  bug
  ory/kratos#4526 · Filter by author phi-luong-codeleap opened on Jan 21, 2026