Release Notes
Release Notes
Breadcrumbs

2026.08.03 - My-Access

AWS-PARIS AWS-DUBLIN S3NS

This release introduces the support of Memority as an external MFA provider for Microsoft Entra ID, new capabilities around OAuth2/OpenID Connect protocols, along with bug fixes and security updates.

Delivery Timeline

  • Staging:

  • Production:

New Features

Memority as an external MFA provider for Microsoft Entra ID
Memority is now supported as an external MFA provider for Microsoft Entra ID allowing users to authenticate with a first factor on Entra ID and with a second factor on Memority.

Read more: Federation and OAuth2


Support for OIDC ACR and AMR claims
Memority now supports Authentication Context Class Reference (ACR) and Authentication Methods References (AMR) claims to be returned in id_token. Applications can request these claims using either acr_values or claims request parameter.

Read more: Federation


Support for ID Token Hint on OAuth2 Authorize Endpoint
The Memority OAuth2 authorize endpoint now accepts id_token_hint parameter allowing to automatically identify the user and thus skip the login page. The claim from the id_token_hint used to identify the user is configurable, and the sub claim can optionally be propagated to the generated ID Token.

Read more: Federation


Duplicate a federation
A federation configuration can now be duplicated to simplify the setup of new federations by reusing existing configurations as a starting point.

Read more: Federation

Improvements and Enhancements

  • Returned the signing certificate and eventually its chain in x5c parameter in Memority OIDC JWKS endpoint

  • Allowed the use of POST verb when calling the Memority OAuth2 authorize endpoint

  • Improved WebAuthn devices type recognition displayed in the Memority enrollments management feature

  • Updated the filter of RBA analytics replays to allow the exclusion of requests with defined user agent. Can be useful to exclude probes requests for example.

  • Improved logs with the addition of connection errors to external OAuth2/OIDC providers

Read more: RBA Replay

Patches

  • Applied technical and security updates to address known vulnerabilities and maintain platform stability.

Bug Fixes

  • Fixed an error preventing federations with a client_id containing "/" from being updated, undeployed, or deleted

  • Fixed an issue where authLevel was not available in attribute functions when using a JWT access token