Quenary/tugtainer v1.31.3 on GitHub

v1.31.3 (2026-08-06)

Important

OIDC login now requires a cryptographically verified ID token. Previously unverified tokens are rejected.

Some setups may stop working if:

the IdP signs ID tokens with a symmetric algorithm (HS256 / HS384 / HS512) instead of asymmetric (RS* / ES*)
the token iss does not exactly match the issuer from the OIDC discovery document (common with mismatched internal vs public Authentik/Keycloak URLs)
the provider does not return an id_token (e.g. openid missing from OIDC_SCOPES)
optional OIDC_ALLOWED_EMAILS / OIDC_ALLOWED_SUBJECTS are set and the user's email/sub is not listed

Typical Authentik/Keycloak configs with RSA-signed tokens and matching issuer URLs should continue to work unchanged.

security: Re-validate notification URLs before send (4aabbc5)
security: Verify OIDC ID tokens and add optional identity allowlist (b55269b)

security: Update README and docker-compose to clarify AGENT_SECRET requirements and usage (3eac9d7)

Detailed Changes: v1.31.2...v1.31.3