17 November 2025

Production release: 17 November 2025
Staging release: 13 November 2025

13 November 2025

• DPoP Support for Subject Delegation - Enhanced security by introducing DPoP (Demonstration of Proof-of-Possession) Authorization for the Subject Delegation Grant.
• WAF Rate Limiting Count - Web Application Firewall (WAF) Rate Limiting is currently set to a counting mode to monitor potential attack volume. This is a preliminary step, and enforcement of WAF Rate Limiting will be implemented in a future release to further strengthen security.
• Application Banner Content : The default One-Time Password (OTP) banner is now standardized and displayed consistently across applications configured for default OTP
• Recovery Code for Users with MFA :The recovery code workflow and supporting changes have been implemented, but the feature flag is presently set to OFF