Authelia v4.39.26 released on 12-09-2026
Authelia v4.39.26 is out now. Operators using OpenID Connect with JARM-enabled clients will see a targeted compatibility fix for unsigned JARM responses.
For full details and to grab the images, see the project’s GitHub release and pull the Docker images: authelia/authelia:4.39.26 or ghcr.io/authelia/authelia:4.39.26.
What’s in this release
- OIDC: accept conformant JARM (JWT Secured Authorization Response Mode) responses that use alg=none — fix for issue #13110 (commit 2ce5b5b).
- Updated Docker images: authelia/authelia:4.39.26 and ghcr.io/authelia/authelia:4.39.26 are published.
- Single targeted bug fix with accompanying security and compatibility notes about unsigned JARM payloads and operator precautions.
Upgrade notes
- Accepting alg=none means Authelia will accept unsigned JARM responses when they are conformant to the spec; review your OIDC provider and client configurations and ensure transport-level protections, audience checks and client authentication are in place.
- Pull and test the image in staging first: docker pull authelia/authelia:4.39.26 (or ghcr.io/authelia/authelia:4.39.26). Back up config and data, exercise OIDC/JARM flows, check logs, then roll out to production with monitoring and a rollback plan.
Share any comments on your experience with the upgrade on the project’s GitHub issue tracker or community channels.
