Nothing open on GitHub. Fix merged in #116734 on 20 Sep 2026. Check it covers your case.
The short answer
- Known?
- Yes. 3 related items grouped here, 1 issue already closed.
- Fix event
- A fix was merged to main in PR #116734. Check it covers your case. No release data is tracked.
- Tracker
- The maintainers' tracker marks this
resolved, deciding PR #116734. That is separate from the fix event. - Still open
- Nothing open on GitHub.
These items address a bug where self-hosted OIDC discovery follows redirects outside the configured issuer origin and trusts the resulting document's self-asserted issuer. The fix pins discovery to the configured issuer origin and rejects documents served from elsewhere.
Open issues0
Open PRs0
Fixes on record
-
#116734 fix(dashboard-auth): self-hosted OIDC discovery rejects documents served from outside the issuer origin (#116373, salvage #116374)
files:
plugins/dashboard_auth/self_hosted/__init__.py,tests/plugins/dashboard_auth/test_self_hosted_provider.py
1 PR closed without merging
From the close comments: merged via another change 1
-
#116374 fix(dashboard-auth): pin OIDC discovery to the configured issuer origin · merged via another change →
07c1953,#116734,#116373,#116374
Closed issues · 1
- Closed#116373[Bug]: Self-hosted OIDC discovery follows redirects off-origin and trusts the document's self-asserted issuer
How this cluster was grouped
-
Link evidence (
structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference. -
Pairwise link density
0.67: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36.1.00means every pair is linked.
Pick up a Lab task
Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.
Open the LabAt a glance
- Merged PRs
- #116734
- Closed issues
- 1
- Attempts
- 1 PR closed without merging
- Fix link checked
- 20 Sep 2026