All issues

Search results

Local mails use Supabase's default templates instead of ours (on SELinux hosts)

bugSomething isn't workingSomething isn't working

Status: Open.

#2783 In supabase/auth;

· cies opened on Sep 3, 2026

sessions_timebox rendered with an 'h' suffix: GoTrue fails to boot on 'invalid duration' (and silently x3600 below the overflow threshold)

Status: Open.

#2770 In supabase/auth;

· bytebyrobert opened on Sep 1, 2026

Passkey login fails with webauthn_verification_failed ("Backup Eligible flag inconsistency") for Apple iCloud synced passkeys on subsequent logins

bugSomething isn't workingSomething isn't working

Status: Open.

#2732 In supabase/auth;

· drandreumartinez opened on Aug 25, 2026

Concurrent MFA verify for the same user returns 500 (FK violation / deadlock) instead of a 4xx conflict

Status: Open.

#2727 In supabase/auth;

· egrish opened on Aug 25, 2026

after-user-created hook fires on every external OAuth sign-in, not just on account creation

bugSomething isn't workingSomething isn't working

Status: Open.

#2726 In supabase/auth;

· swithek opened on Aug 24, 2026

.ConfirmationURL drops path/query from redirect_to at email-send time, even though /auth/v1/verify honors it correctly when supplied directly

Status: Open.

#2722 In supabase/auth;

· mmzbht opened on Aug 22, 2026

OAuth 2.1 server: authorize rejects RFC 8252 loopback ephemeral-port redirect_uri (exact-match, no port exemption)

Status: Open.

#2703 In supabase/auth;

· ralph-cmyk opened on Aug 17, 2026

POST /auth/v1/recover returns email_address_invalid for an existing user and success for a missing user (account enumeration)

Status: Open.

#2702 In supabase/auth;

· EdmarSantos42 opened on Aug 16, 2026

Custom OIDC provider discards non-standard claims — CustomClaims passthrough exists only for Keycloak

Status: Open.

#2694 In supabase/auth;

· mikaelha opened on Aug 11, 2026

Audit log entries for identity_unlinked are written with an empty log_type

Status: Open.

#2679 In supabase/auth;

· evanmarshall opened on Aug 6, 2026

Concurrent /otp signup race for the same new email: losing request returns raw 500 (users_email_partial_key, aborted transaction) instead of a graceful response

Status: Open.

#2675 In supabase/auth;

· beedabug opened on Aug 4, 2026

Password grant leaks account existence via timing: no hash verify on the unknown-user path

Status: Open.

#2674 In supabase/auth;

· fireandsafetyca-lang opened on Aug 4, 2026