3.8.5 / 2026-05-19

Security

• Fix issue where the safe URL redirect validator could be bypassed on certain browsers possibly allowing an attacker the ability to phish other users

Translations

• Add Indonesian translations

API

• Fix issue when updating a challenge where initial, minimum, and decay could not be set to NULL even if the challenge function is static

Deployment

• Fix issue with subdirectory deployments where users could not authenticate on certain server configurations