Issues

• Harden default: clients.http.disallow_private_ip_ranges ships false, leaving self-hosted deployments open to SSRF via client metadata URLs

  bug
  ory/hydra#4132 · Filter by author kenjoe41 opened on Oct 6, 2026

• Revisit Cosmos DB for NoSQL persistence: a correctness-first feasibility proposal

  Needs Triage
  ory/hydra#4131 · Filter by author tvaron3 opened on Oct 6, 2026
  3

• serve.admin.request_log.disable_for_health has no effect: health paths missing /admin prefix in exclusion list

  Needs Triage
  ory/hydra#4130 · Filter by author tomers opened on Sep 14, 2026
  1

• Accepting login challenge with remember: true, remember_for: 0 creates cookie with 30-day expiration

  bug
  ory/hydra#4126 · Filter by author Conduitry opened on Sep 2, 2026
  1

• Device verification GET query parameters are not propagated to the authorization request

  Needs Triage
  ory/hydra#4118 · Filter by author chux0519 opened on Jul 30, 2026

• SetClientAssertionJWT inline DELETE on hydra_oauth2_jti_blacklist causes lock contention and latency spikes under concurrent load

  bug
  ory/hydra#4113 · Filter by author jmicho-inpost opened on Jul 1, 2026
  3

• oauth2: Missing code_verifier parameter in token exchange OpenAPI spec

  bug
  ory/hydra#4099 · Filter by author chirag1807 opened on May 1, 2026

• ci: surface breaking-change drift on spec/api.json

  ory/hydra#4097 · Filter by author infracore opened on Apr 26, 2026
  1

• PATCHing an OAuth Client clears the registration access token

  bug
  ory/hydra#4093 · Filter by author OMBradF opened on Apr 22, 2026

• Default page_size for GET /admin/clients reduced to 100 — undocumented breaking change

  bug
  ory/hydra#4092 · Filter by author nellynp opened on Apr 15, 2026

• Post Quantum Roadmap

  feat
  ory/hydra#4091 · Filter by author ston1th opened on Apr 14, 2026
  8

• OIDC Dynamic Client Registration - PUT does not return registration_client_uri

  bug
  ory/hydra#4084 · Filter by author daniel-eichinger-snkeos opened on Mar 19, 2026

• Bug: AcceptOAuth2LogoutRequest returns before session is invalidated, causing silent re-authentication race condition

  bug
  ory/hydra#4070 · Filter by author dferenc-netwizzy opened on Feb 20, 2026
  1

• [Code Flow, Ory Hydra 2.3.0] "nonce" is omitted in ID Token when passed as request parameter (not inside signed JWT Request Object)

  bug
  ory/hydra#4069 · Filter by author RomanTopalov opened on Feb 19, 2026
  2

• feat: Add HTTP client configuration options for token_hook to improve performance

  feat
  ory/hydra#4067 · Filter by author kamalshkeir opened on Feb 11, 2026
  1

• Support "Client ID Metadata Document" (CIMD)

  feat
  Feature

  ory/hydra#4061 · Filter by author rawnsley opened on Jan 17, 2026
  7

• Optional Access Token Strategy for Dynamic Client Registration

  feat
  ory/hydra#4060 · Filter by author vichanse opened on Jan 15, 2026

• Configuration of the csrf cookies paths

  feat
  ory/hydra#4059 · Filter by author daniel-eichinger-snkeos opened on Jan 13, 2026

• Allow custom request parameters forwarded to token hook request payload

  feat
  ory/hydra#4055 · Filter by author wizardist opened on Dec 22, 2025

• skip_logout_consent has invalid default value

  bug
  ory/hydra#4052 · Filter by author lutzp opened on Dec 16, 2025
  1

• Allow setting default values for optional DCR values

  backlogfeat
  Bug

  ory/hydra#4044 · Filter by author xqqp opened on Nov 22, 2025
  3

• Logout token does not contains exp claim

  bug
  ory/hydra#4035 · Filter by author JonasFisch opened on Oct 16, 2025

• Support unsetting jwks_uri from .well-known/openid-configuration endpoint

  featstale
  ory/hydra#4029 · Filter by author David-Wobrock opened on Sep 26, 2025
  1

• Add Janitor removing expired tokens by client_secret_expires_at

  featstale
  ory/hydra#4026 · Filter by author astudnev opened on Sep 12, 2025
  1

• OAuth2 Token Revocation Endpoint Returns 200 OK for Invalid Scenarios (Empty Token & Wrong Client Credentials)

  bug
  ory/hydra#4025 · Filter by author hariharan-affordmed opened on Sep 2, 2025