Issues

• TOTP enrollment returns 500 for phone-only users (empty TOTP account name)

  supabase/auth#2872 · Filter by author emiliosandoval4 opened on Oct 14, 2026

• Hosted project: revoked refresh tokens are never deleted (DB cleanup appears not to run)

  supabase/auth#2870 · Filter by author harveenatwal opened on Oct 13, 2026

• openapi.yaml seems to drift from the admin handlers in several places

  supabase/auth#2859 · Filter by author QuintinWillison opened on Oct 7, 2026
  3

• MFA challenge returns 500 when two factors are challenged at the same instant (unique constraint on mfa_factors.last_challenged_at)

  supabase/auth#2854 · Filter by author peytonhobson opened on Oct 6, 2026

• Postgres-function hooks given a non-transactional connection run set local statement_timeout outside a transaction: timeout not enforced, 25P01 logged (before_user_created, after_user_created, MFA send_sms)

  supabase/auth#2852 · Filter by author aerotech-vadb opened on Oct 6, 2026

• OAuth 2.1 server: support Client ID Metadata Documents (URL client_id) for MCP clients

  supabase/auth#2850 · Filter by author alana-datum opened on Oct 2, 2026

• Steam sign-in: would a first-party provider be considered? (OpenID 2.0 + Steamworks session tickets)

  supabase/auth#2849 · Filter by author SasoriOlkof opened on Oct 2, 2026

• updateUser({email}) fails with "Email address \"\" is invalid" when linking an email to an anonymous user with no prior email

  supabase/auth#2847 · Filter by author lh-lena opened on Oct 1, 2026

• Admin generate_link strips the path from options.redirect_to, always returns origin-only

  supabase/auth#2839 · Filter by author kenlyle2 opened on Sep 28, 2026
  1

• OAuth 2.1 server: no way to require MFA (aal2) for OAuth client access tokens

  bug
  supabase/auth#2838 · Filter by author jhurleyai opened on Sep 28, 2026

• Document what a passkey session's access token contains (amr, aal, timestamp): needed for step-up auth

  documentation
  supabase/auth#2832 · Filter by author GitHubTracey opened on Sep 25, 2026
  1

• Unset GOTRUE_DB_MAX_IDLE_POOL_SIZE disables connection reuse since #2177, exhausting ephemeral ports under load

  supabase/auth#2831 · Filter by author fabianoxyz opened on Sep 24, 2026

• OAuth token endpoint returns non-standard error for missing refresh token

  supabase/auth#2829 · Filter by author fedster99 opened on Sep 23, 2026
  1

• GoTrue rejects valid ES256 tokens after signing-key rotation due to JWKS cache not refreshing at runtime

  supabase/auth#2821 · Filter by author Lihini-KP opened on Sep 21, 2026

• OAuth 2.1 Server (beta): GET /oauth/authorizations/{id} returns 400 when resource, offline_access, or a public client is used — blocks MCP connectors

  supabase/auth#2820 · Filter by author maiconbatistaaa opened on Sep 20, 2026

• Proposal: per-token failed-attempt limit for OTP verification

  bug
  supabase/auth#2819 · Filter by author danieldickison opened on Sep 18, 2026

• RefreshTokenGrant leaks raw internal error text to API clients in the msg field

  supabase/auth#2812 · Filter by author Rakshit-gen opened on Sep 15, 2026

• IsUniqueConstraintViolatedError does not recognize a real Postgres unique violation, identity link race returns 500 instead of 422

  supabase/auth#2810 · Filter by author Rakshit-gen opened on Sep 15, 2026

• OAuth 2.1 server: MFA verification deletes OAuth client sessions (InvalidateSessionsWithAALLessThan does not exclude oauth_client_id)

  bug
  supabase/auth#2801 · Filter by author cgeorgakopoulos-sleed opened on Sep 12, 2026
  5

• Azure provider: "Error getting user profile from external provider" using the documented /consumers tenant URL for personal accounts REPO: supabase/auth (github.com/supabase/auth/issues)

  bug
  supabase/auth#2795 · Filter by author iohinted-prog opened on Sep 9, 2026
  1

• Local mails use Supabase's default templates instead of ours (on SELinux hosts)

  bug
  supabase/auth#2783 · Filter by author cies opened on Sep 3, 2026
  1

• sessions_timebox rendered with an 'h' suffix: GoTrue fails to boot on 'invalid duration' (and silently x3600 below the overflow threshold)

  supabase/auth#2770 · Filter by author bytebyrobert opened on Sep 1, 2026
  1

• Passkey login fails with webauthn_verification_failed ("Backup Eligible flag inconsistency") for Apple iCloud synced passkeys on subsequent logins

  bug
  supabase/auth#2732 · Filter by author drandreumartinez opened on Aug 25, 2026
  1

• Concurrent MFA verify for the same user returns 500 (FK violation / deadlock) instead of a 4xx conflict

  supabase/auth#2727 · Filter by author egrish opened on Aug 25, 2026
  1

• .ConfirmationURL drops path/query from redirect_to at email-send time, even though /auth/v1/verify honors it correctly when supplied directly

  supabase/auth#2722 · Filter by author mmzbht opened on Aug 22, 2026
  1