Repository Issue Activity (beta)

#4126 Accepting login challenge with `remember: true, remember_for: 0` creates cookie with 30-day expiration

#4091 Post Quantum Roadmap

#3990 Support JWKS_URI for trust grant issuer

#3610 Jwt grant expired, but it still can use

#4011 Expose Prometheus Metrics for OAuth Client Operations (e.g. Token Requests)

#3132 Cannot force front/back-channel logout with id_token_hint when "Remember Me" is off

#3604 Competing refresh token requests can cause concurrent update issues on PostgreSQL

#4118 Device verification GET query parameters are not propagated to the authorization request

#4043 Ory hydra altering scopes in JWT token claims when requested scope contains a pipe '|'

#3740 Assertions may be reused & dead lock

#4113 SetClientAssertionJWT inline DELETE on hydra_oauth2_jti_blacklist causes lock contention and latency spikes under concurrent load

#3829 Incorrect Handling of Scopes with Special Character "|" in scp Claim

#3742 Add `prompt=create` alias for `prompt=registration`

#3622 Opentelemetry spans names have changed when changed tracing_provider

#4053 login_challenge decryption fails on Apple Silicon (M2 Max) + Docker Desktop + Apple Virtualization Framework

#4044 Allow setting default values for optional DCR values

#1218 Support RFC8693: Token Exchange

#3611 Add the introspection endpoint to the discovery response

#4116 DCR response includes "contacts": null and an empty (unparseable) "client_uri": "" for unset fields, breaking strict RFC 7591 client parsers (mcp-remote, Cursor's native MCP client, MCP TypeScript SDK)

#4061 Support "Client ID Metadata Document" (CIMD)

#4110 Device flow: denied consent does not return access_denied to the polling client (UserCodeRejected never set)

#4104 hydra/fosite/authorize_helper.go deviates from ory/fosite/authorize_helpers around 8252

#4038 Postgres Migration does not work since DB does not support md5 hash due to FIPS

#4013 Make ui_locales validation configurable

#3581 Unexpected bug authenticating a valid client