DATE:: October 19, 2026
AUTHOR:: Ory Team

Ory Network Ory Hydra Ory Kratos Ory Keto Ory Oathkeeper Ory Polis Ory Elements Ory Enterprise License

Ory Network, Ory Hydra, Ory Kratos, Ory Polis, Ory Elements v26.4.3 released

DATE: October 19, 2026

AUTHOR: Ory Team

Ory Network

Configure the length and characters of one-time codes

You can now set the length and characters of the one-time codes that Ory Kratos Identities sends for login, registration, verification, and account recovery. Use the Ory CLI or the project API to set selfservice.methods.code.config.length to a value from 6 to 20, and selfservice.methods.code.config.alphabet to digits or alphanumeric. Alphanumeric codes use lowercase letters and digits without easily confused characters, and users can enter them in any letter case. Codes stay six digits unless you change these settings.

Ory Account Experience shows a single text field for codes longer than eight characters. If your email or SMS templates describe the code as six digits, update them when you change the format. See One-time code format.

This is now available on Ory Network.

Ory Hydra

Client assertion JWT IDs work with non-UTC database time zones

Ory Hydra now tracks the jti of client assertion JWTs correctly when the PostgreSQL or CockroachDB session time zone is not UTC. Before, Hydra removed jti values too early or too late, depending on the time zone offset. As a result, Hydra could accept a jti that was still in use, or reject a jti whose earlier use had already expired. See ory/hydra#3740.

Scopes and audiences containing a pipe character are preserved

A scope or audience value that contains |, such as the SMART App Launch scope patient/Observation.rs?code=http://loinc.org|1234-5, used to come back split into several values in the issued access token and the introspection response, and refreshing such a token failed. Tokens and codes issued after the upgrade keep these values intact and refresh normally. Tokens issued before the upgrade still carry the split values until they expire. To restore a refresh token issued before the upgrade, send the user through the authorization flow again.

This is now available on Ory Network, for the Ory Enterprise License, and will be part of the next Ory Open Source release.

Ory Kratos

Configure the length and characters of one-time codes

Ory Kratos Identities has two new settings for the one-time codes it sends for login, registration, verification, and account recovery: selfservice.methods.code.config.length takes a value from 6 to 20, and selfservice.methods.code.config.alphabet takes digits or alphanumeric. Alphanumeric codes use lowercase letters and digits without easily confused characters, and users can enter them in any letter case. Codes stay six digits unless you change these settings.

The code input node now carries maxlength, pattern, and a new inputmode attribute that match the configured format. Render inputmode in custom UIs so mobile devices show a keyboard with letters for alphanumeric codes. Ory Elements reads it and shows a single text field for codes longer than eight characters. See One-time code format.

Configure the length and characters of one-time codes

De-activating an identity revokes its sessions

Setting an identity's state to inactive through the admin API now revokes all of its sessions. Before, the sessions stayed active and were only rejected while the identity was inactive, so activating the identity again restored them. Now an identity that is activated again must sign in again.

This is now available on Ory Network, for the Ory Enterprise License, and will be part of the next Ory Open Source release.

Ory Polis

Failed SAML logouts show up in the Admin Portal

A SAML single logout that fails, when Polis starts it or when the identity provider answers, now saves an SSO trace, as a failed sign-in does. The trace holds the tenant, product, connection, RelayState, the issuer and the LogoutRequest or LogoutResponse, and the Admin Portal labels it "SAML Single Logout". Its ID is the polis.sso_trace.id on the logout's span and log record. SSO traces gain an isSLO field.

The polis.idfed.logout.response log record and span now carry the tenant, product, identity federation app and upstream connection of the logout, and the log record carries the signed LogoutResponse Polis sends to the service provider as polis.saml.response, unless SSO_TELEMETRY_REDACT=true. Identity federation logouts started before this release still complete, without these attributes.

A signed LogoutResponse from the identity provider that cannot be parsed now fails with error.type=saml_invalid instead of _OTHER.

An identity federation logout now carries the polis.login.id of the login it ends. The SessionIndex of a federated SAML response holds the login ID in place of random digits, keeping its length, and Polis reads it back from the service provider's LogoutRequest. Unless the app verifies logout request signatures, the service provider chooses this value, so use it to correlate telemetry only.

ID tokens Polis issues now carry a polis_login_id claim, the ID of the login. /api/logout accepts an optional id_token_hint: send the ID token of the login being ended, expired or not, and the logout's log records and spans carry that login's polis.login.id. A hint Polis did not sign is ignored and the logout goes ahead.

A login that goes through the IdP selection page, or the app selection page of an IdP-initiated login, now keeps its polis.login.id after the user chooses, instead of starting again with a new one. Polis relays the ID through the page in a polis_login_id parameter, which is never forwarded to the IdP.

OIDC connection updates keep the provider metadata complete

An update to an OIDC connection through PATCH /api/v1/sso that sent only some oidcMetadata fields, or an empty value, could save a connection without an issuer, authorization_endpoint, token_endpoint, userinfo_endpoint or jwks_uri, and logins through it then failed. This included switching a connection from its discovery URL to metadata. Polis now rejects such an update with 400 and keeps the connection as it was. Updates that leave all five fields in place, including ones that send only the fields that change, work as before.

SAML logout completes when the IdP answers with the HTTP-Redirect binding

/api/logout/callback now accepts a LogoutResponse sent with the HTTP-Redirect binding. Previously an identity provider that answered a single logout this way always got an error, because the response was neither inflated nor checked against the signature on its query string.

Polis verifies the query-string signature with the IdP certificates stored on the connection that started the logout, and accepts SHA-256, SHA-384 and SHA-512 signatures only. An unsigned response, a response altered after signing, or a SAMLResponse or RelayState sent twice is refused with 403 Forbidden. If a connection stored only the IdP certificate's thumbprint, update it with the IdP metadata again.

The IdP selection page appears for every tenant with more than one connection

When a tenant and product had more SSO connections than one database page holds, or an identity provider served more apps than that, Polis looked at the first page only and could send the user straight to the first connection or app instead of letting them choose. Polis now reads every connection before deciding, for SP-initiated logins, Identity Federation apps and IdP-initiated logins. An Identity Federation app that lists a tenant twice no longer offers that tenant's connections twice.

This is now available for the Ory Enterprise License and will be part of the next Ory Open Source release.

Ory Elements

Configure the length and characters of one-time codes

This is now available for the Ory Enterprise License and will be part of the next Ory Open Source release.

Ory Terraform

No significant changes in this release.