{"collection":{"slug":"auth-identity","name":"Auth & Identity"},"digest":{"id":"cwd_j-hTDOXgbNKPsG-1rkzMi","weekStart":"2026-05-25","title":"Debugging emails, hardening auth, and SSO everywhere","intro":"Clerk launched Email Logs in public beta for debugging delivery issues, while Better Auth patched several high-severity security flaws. Auth0 shipped GA passkeys with cross-subdomain support and organization-scoped Token Vault, and Clerk added self-serve SSO configuration across its SDKs.","body":"### Debugging transactional email delivery\n\nClerk introduced [Email Logs in public beta](/release/rel_hHKhlhSI_ocb24j_Y0YRn-clerk-email-logs-public-beta-enables-dashboard-email-debugging), giving production instances a reverse-chronological view of every transactional email Clerk sends. You can filter by recipient, message ID, event type, or IP address, and inspect delivery status, bounce reasons, and raw provider payloads — all from the Clerk Dashboard. For teams debugging why a verification or invitation email never arrived, this removes the need to check a third-party email service or parse server-side logs.\n\n### Hardening across Better Auth\n\nBetter Auth shipped three patch releases this week addressing multiple security issues. [v1.6.12](/release/rel_mjrK9jVs1_4ayVmf-Qq1g-better-auth-v1-6-12-fixes-session-cookie-leak-and-passkey-replay-attacks) fixed a session cookie leak that allowed `session_token` and `session_data` cookies to be captured and replayed to bypass 2FA when cookie caching was enabled, and made passkey challenges atomic to prevent replay attacks. [v1.6.13](/release/rel_z5PSaR4FZNUVfQpT1QKwk-better-auth-v1-6-13-fixes-xml-injection-in-saml-and-oauth-state-storage) patched a high-severity XML injection vulnerability in signed SAML assertions and a `stateStrategy` defaulting bug that caused oversized-cookie errors on AWS Lambda — plus fixes for Google One Tap authenticating the wrong user after account linking, unauthorized dynamic OAuth client registration, and SAML Single Logout that left users signed in. [v1.7.0-beta.4](/release/rel_dZsvrOt1qcR7SvCkZyPxj-better-auth-v1-7-0-beta-4-hardens-oauth-and-oidc-security-fixes-resource) hardens OAuth and OIDC further, binding RFC 8707 resource indicators to the authorization grant and fixing PKCE validation, state-cookie handling, and redirect URI validation. Any team using Better Auth's SAML or OAuth flows should upgrade immediately.\n\n### Passkeys and token vault reach GA at Auth0\n\nAuth0's [Passkeys feature with customizable RPID](/release/rel_Bh3zBfui-byxePfnCkbBV-auth0-passkeys-now-supports-customizable-rpid-for-cross-subdomain-enrollment) is now generally available, allowing a single passkey to authenticate users across multiple applications under the same root domain — useful for teams with several subdomain-hosted services that want shared enrollment. Separately, [Token Vault with Organization Support](/release/rel_JbKX4VlYfmZcMQdLXpc5q-auth0-token-vault-with-organization-support-reaches-ga) reached GA, scoping third-party token exchanges to `(user, org_id)` pairs so each organization in a multi-tenant B2B app maintains isolated token records.\n\n### Self-serve SSO rolls out across Clerk SDKs\n\nClerk's JavaScript SDK [v6.13.0](/release/rel_y9eJXNawoaxGfSYwObGL2-clerk-javascript-sdk-v6-13-0-displays-sso-section-in-organizationprofile) and the underlying [UI components](/release/rel_a5YiJMVWpzxdq5xc_Clau-clerk-javascript-sdk-clerk-ui-1-14-0-migrates-to-new-icon-set-and-adds-sso) now display a \"Single Sign-on (SSO)\" section in `OrganizationProfile` whenever self-serve SSO is enabled for the active organization. The ConfigureSSO UX was improved with attribute-mapping labels per IdP nomenclature, a test URL button, and clearer empty states. The [localizations package](/release/rel_QCk3GRl0UvN2Xg8EmcZTM-clerk-javascript-sdk-clerk-localizations-4-7-0-adds-sso-section-to) also gained complete translations for Bengali, Hindi, Malay, Tamil, and Telugu, filling previously untranslated keys across billing, sign-in, and MFA flows.\n\nElsewhere, Clerk added [Expo SDK 56 support](/release/rel_kdmOUoaFZA7Dt8SLbNr1d-clerk-javascript-sdk-clerk-expo-3-3-0-adds-expo-sdk-56-support) and [fixed Astro View Transitions styling loss](/release/rel_kxJFtHb2h3qaxhv-Jeg1x-clerk-astro-sdk-clerk-astro-3-3-2-fixes-component-styling-loss-on-view). And [@clerk/shared v3.47.7](/release/rel_9Ajq0e9LgR8rTrE1KO0uB-clerk-shared-v3-47-7-adds-oiat-field-to-jwtheader-for-token-freshness-checks) added an `oiat` field to JWT headers to support monotonic token freshness checks in session minter.","releaseIds":["rel_hHKhlhSI_ocb24j_Y0YRn","rel_mjrK9jVs1_4ayVmf-Qq1g","rel_z5PSaR4FZNUVfQpT1QKwk","rel_dZsvrOt1qcR7SvCkZyPxj","rel_Bh3zBfui-byxePfnCkbBV","rel_JbKX4VlYfmZcMQdLXpc5q","rel_y9eJXNawoaxGfSYwObGL2","rel_a5YiJMVWpzxdq5xc_Clau","rel_QCk3GRl0UvN2Xg8EmcZTM","rel_kdmOUoaFZA7Dt8SLbNr1d","rel_kxJFtHb2h3qaxhv-Jeg1x","rel_9Ajq0e9LgR8rTrE1KO0uB"],"releaseCount":59,"generatedAt":"2026-07-11T17:02:28.721Z","releases":[{"id":"rel_hHKhlhSI_ocb24j_Y0YRn","title":"Clerk Email Logs public beta enables dashboard email debugging","path":"/release/rel_hHKhlhSI_ocb24j_Y0YRn-email-logs-now-in-public-beta-inspect-delivery-from-dashboard","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_mjrK9jVs1_4ayVmf-Qq1g","title":"better-auth v1.6.12 fixes session cookie leak and passkey replay attacks","path":"/release/rel_mjrK9jVs1_4ayVmf-Qq1g-session-cookie-leak-plugged-passkey-challenges-now-atomic","org":{"slug":"better-auth","name":"Better Auth"},"importance":null},{"id":"rel_z5PSaR4FZNUVfQpT1QKwk","title":"better-auth v1.6.13 fixes XML injection in SAML and OAuth state storage regression","path":"/release/rel_z5PSaR4FZNUVfQpT1QKwk-saml-xml-injection-patched-oauth-state-storage-fixed","org":{"slug":"better-auth","name":"Better Auth"},"importance":null},{"id":"rel_dZsvrOt1qcR7SvCkZyPxj","title":"better-auth v1.7.0-beta.4 hardens OAuth and OIDC security, fixes resource indicators","path":"/release/rel_dZsvrOt1qcR7SvCkZyPxj-rfc-8707-resource-indicators-bound-to-authorization-grant-oauth-security","org":{"slug":"better-auth","name":"Better Auth"},"importance":null},{"id":"rel_Bh3zBfui-byxePfnCkbBV","title":"Auth0 Passkeys now supports customizable RPID for cross-subdomain enrollment","path":"/release/rel_Bh3zBfui-byxePfnCkbBV-passkeys-now-work-across-subdomains-with-custom-rpid","org":{"slug":"auth0","name":"Auth0"},"importance":null},{"id":"rel_JbKX4VlYfmZcMQdLXpc5q","title":"Auth0 Token Vault with Organization Support reaches GA","path":"/release/rel_JbKX4VlYfmZcMQdLXpc5q-token-vault-now-organization-scoped-multi-tenant-isolation-built-in","org":{"slug":"auth0","name":"Auth0"},"importance":null},{"id":"rel_y9eJXNawoaxGfSYwObGL2","title":"Clerk JavaScript SDK v6.13.0 displays SSO section in OrganizationProfile","path":"/release/rel_y9eJXNawoaxGfSYwObGL2-organizationprofile-shows-sso-section-when-enabled","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_a5YiJMVWpzxdq5xc_Clau","title":"Clerk JavaScript SDK @clerk/ui@1.14.0 migrates to new icon set and adds SSO section","path":"/release/rel_a5YiJMVWpzxdq5xc_Clau-icon-set-migrated-for-consistency-sso-section-added-to-organizationprofile","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_QCk3GRl0UvN2Xg8EmcZTM","title":"Clerk JavaScript SDK @clerk/localizations@4.7.0 adds SSO section to OrganizationProfile","path":"/release/rel_QCk3GRl0UvN2Xg8EmcZTM-organizationprofile-shows-sso-section-when-enabled-five-language-packs-completed","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_kdmOUoaFZA7Dt8SLbNr1d","title":"Clerk JavaScript SDK @clerk/expo@3.3.0 adds Expo SDK 56 support","path":"/release/rel_kdmOUoaFZA7Dt8SLbNr1d-expo-sdk-56-now-supported","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_kxJFtHb2h3qaxhv-Jeg1x","title":"Clerk Astro SDK @clerk/astro@3.3.2 fixes component styling loss on View Transitions","path":"/release/rel_kxJFtHb2h3qaxhv-Jeg1x-component-styling-no-longer-lost-after-view-transitions","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_9Ajq0e9LgR8rTrE1KO0uB","title":"@clerk/shared v3.47.7 adds oiat field to JwtHeader for token freshness checks","path":"/release/rel_9Ajq0e9LgR8rTrE1KO0uB-jwtheader-now-includes-oiat-field-for-monotonic-token-freshness","org":{"slug":"clerk","name":"Clerk"},"importance":null}]}}