Begin forwarded message:

From: Henri Mikkonen <henri.mikkonen@nimbleidm.com>

Subject: OIDC OP plugin v4.3.3 now available

Date: 9 November 2026 at 15:52:37 GMT+1

To: announce@shibboleth.net

Reply-To: users@shibboleth.net

The Shibboleth Project has released V4.3.3 of the OIDC OP plugin (see release notes at [1])

The primary reason for the patch is fixes for two security issues related to unescaped form parameters with form_post response mode and Pushed Authorization (PAR) not storing the verified DPoP proof thumbprint. There will be two security advisories published right after this announcement with additional details to finalize the release.

-- Henri Mikkonen, on behalf of the team

[1] https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2776760321/OPReleaseNotes
--
To unsubscribe from this list send an email to announce-unsubscribe@shibboleth.net