Issues

Proxy outpost (Rust, 2026.8.0) sends duplicate Host header on token backchannel — nginx rejects with 400, forward auth loops (ERR_TOO_MANY_REDIRECTS)
#25226 · przwr opened on Aug 19, 2026
3
Unable to access dashboard or login after upgrade from 2026.5 -> 2026.8
#25559 · HeyItsJono opened on Aug 28, 2026
12

upgrade from 2026.5.7 to 2026.8.3 crashes server
Bug
goauthentik/authentik#26723 · opened on Oct 6, 2026
1
SCIM does not add user to group when user is created with a group
Bug
goauthentik/authentik#26721 · opened on Oct 5, 2026
When using ForwardAuth, Basic Authentication and Caddy Authentication header always get's intercepted
Bug
goauthentik/authentik#26711 · opened on Oct 5, 2026
Postgresql tls client certificate login still failing.
Bug
goauthentik/authentik#26710 · opened on Oct 5, 2026
1
Server logs false-positive warn on /health/live/ during startup: client error (Connect) no such file or directory (os error 2)
Bug
goauthentik/authentik#26686 · opened on Oct 4, 2026
Cannot remove RegEx value from Object Attribute
Bug
goauthentik/authentik#26685 · opened on Oct 4, 2026
1
Proxy providers re-saved continuously without changes, so permissions are rebuilt and the embedded outpost reloads in a loop (2026.8.2 / 2026.8.3)
goauthentik/authentik#26684 · opened on Oct 4, 2026
feat(web): Add PWA Web App Manifest and icons for mobile installability
goauthentik/authentik#26678 · opened on Oct 3, 2026
Authorisation failure when using default-source-authentication flow
Bug
goauthentik/authentik#26677 · opened on Oct 3, 2026
User switching: after adding an external user, the browser cannot switch back
Bug
goauthentik/authentik#26676 · opened on Oct 3, 2026
Proxy outpost (Rust, 2026.8): concurrent logins from several tabs of the same app mint different session IDs; losing tabs dead-end on a bare 400 at the callback
Bug
goauthentik/authentik#26642 · opened on Oct 2, 2026
Parallel tabs all start SP-initiated SAML login when the identification stage auto-redirects to a single source N-1 fail at ACS (continuous login never engages)
Bug
goauthentik/authentik#26641 · opened on Oct 2, 2026
MFA doesn't use last used device class like documented
Bug
goauthentik/authentik#26618 · opened on Oct 1, 2026
Fine grained access requests for object attributes
Feature
goauthentik/authentik#26608 · opened on Oct 1, 2026 · Future release
1
Invitation Wizard Send Invitation via Email Form Sizing issues
Bug
goauthentik/authentik#26593 · opened on Sep 30, 2026
High CPU load after upgrade to 2026.8.x
Bug
goauthentik/authentik#26592 · opened on Sep 30, 2026
3
NameID Policy in SAML Sources: "Undefined" Option Missing
Bug
goauthentik/authentik#26590 · opened on Sep 30, 2026 · Release 2026.11.0: Nice to have
end-session with an unfinished flow leads to blank page
Bug
goauthentik/authentik#26561 · opened on Sep 29, 2026
Samsung Pass enrollment fails with DIRECT attestation due to ASN.1 certificate parsing error
Bug
goauthentik/authentik#26544 · opened on Sep 29, 2026
1
Block creation of non utf-8 db's
goauthentik/authentik#26474 · opened on Sep 27, 2026 · Release 2027.2.0: Required
Remove legacy secret columns
goauthentik/authentik#26473 · opened on Sep 27, 2026 · Release 2027.2.0: Required
Remove legacy password fields
goauthentik/authentik#26472 · opened on Sep 27, 2026 · Release 2027.2.0: Required
Outpost reconnect backoff never resets after a healthy WebSocket session
goauthentik/authentik#26463 · opened on Sep 27, 2026
SCIM: group PATCH always sends externalId, which an immutable-externalId provider rejects
goauthentik/authentik#26450 · opened on Sep 26, 2026
Proxy outpost (Rust): a request between /start and the callback deletes the session cookie, callback returns a bare 400
Bug
goauthentik/authentik#26447 · opened on Sep 26, 2026