--- collection: auth-identity collection_name: Auth & Identity week_start: 2026-05-25 title: Debugging emails, hardening auth, and SSO everywhere release_count: 59 generated: 2026-07-11 canonical: https://releases.sh/collections/auth-identity/digest/2026-05-25 --- # Debugging emails, hardening auth, and SSO everywhere Clerk launched Email Logs in public beta for debugging delivery issues, while Better Auth patched several high-severity security flaws. Auth0 shipped GA passkeys with cross-subdomain support and organization-scoped Token Vault, and Clerk added self-serve SSO configuration across its SDKs. ### Debugging transactional email delivery Clerk introduced [Email Logs in public beta](/release/rel_hHKhlhSI_ocb24j_Y0YRn-clerk-email-logs-public-beta-enables-dashboard-email-debugging), giving production instances a reverse-chronological view of every transactional email Clerk sends. You can filter by recipient, message ID, event type, or IP address, and inspect delivery status, bounce reasons, and raw provider payloads — all from the Clerk Dashboard. For teams debugging why a verification or invitation email never arrived, this removes the need to check a third-party email service or parse server-side logs. ### Hardening across Better Auth Better Auth shipped three patch releases this week addressing multiple security issues. [v1.6.12](/release/rel_mjrK9jVs1_4ayVmf-Qq1g-better-auth-v1-6-12-fixes-session-cookie-leak-and-passkey-replay-attacks) fixed a session cookie leak that allowed `session_token` and `session_data` cookies to be captured and replayed to bypass 2FA when cookie caching was enabled, and made passkey challenges atomic to prevent replay attacks. [v1.6.13](/release/rel_z5PSaR4FZNUVfQpT1QKwk-better-auth-v1-6-13-fixes-xml-injection-in-saml-and-oauth-state-storage) patched a high-severity XML injection vulnerability in signed SAML assertions and a `stateStrategy` defaulting bug that caused oversized-cookie errors on AWS Lambda — plus fixes for Google One Tap authenticating the wrong user after account linking, unauthorized dynamic OAuth client registration, and SAML Single Logout that left users signed in. [v1.7.0-beta.4](/release/rel_dZsvrOt1qcR7SvCkZyPxj-better-auth-v1-7-0-beta-4-hardens-oauth-and-oidc-security-fixes-resource) hardens OAuth and OIDC further, binding RFC 8707 resource indicators to the authorization grant and fixing PKCE validation, state-cookie handling, and redirect URI validation. Any team using Better Auth's SAML or OAuth flows should upgrade immediately. ### Passkeys and token vault reach GA at Auth0 Auth0's [Passkeys feature with customizable RPID](/release/rel_Bh3zBfui-byxePfnCkbBV-auth0-passkeys-now-supports-customizable-rpid-for-cross-subdomain-enrollment) is now generally available, allowing a single passkey to authenticate users across multiple applications under the same root domain — useful for teams with several subdomain-hosted services that want shared enrollment. Separately, [Token Vault with Organization Support](/release/rel_JbKX4VlYfmZcMQdLXpc5q-auth0-token-vault-with-organization-support-reaches-ga) reached GA, scoping third-party token exchanges to `(user, org_id)` pairs so each organization in a multi-tenant B2B app maintains isolated token records. ### Self-serve SSO rolls out across Clerk SDKs Clerk's JavaScript SDK [v6.13.0](/release/rel_y9eJXNawoaxGfSYwObGL2-clerk-javascript-sdk-v6-13-0-displays-sso-section-in-organizationprofile) and the underlying [UI components](/release/rel_a5YiJMVWpzxdq5xc_Clau-clerk-javascript-sdk-clerk-ui-1-14-0-migrates-to-new-icon-set-and-adds-sso) now display a "Single Sign-on (SSO)" section in `OrganizationProfile` whenever self-serve SSO is enabled for the active organization. The ConfigureSSO UX was improved with attribute-mapping labels per IdP nomenclature, a test URL button, and clearer empty states. The [localizations package](/release/rel_QCk3GRl0UvN2Xg8EmcZTM-clerk-javascript-sdk-clerk-localizations-4-7-0-adds-sso-section-to) also gained complete translations for Bengali, Hindi, Malay, Tamil, and Telugu, filling previously untranslated keys across billing, sign-in, and MFA flows. Elsewhere, Clerk added [Expo SDK 56 support](/release/rel_kdmOUoaFZA7Dt8SLbNr1d-clerk-javascript-sdk-clerk-expo-3-3-0-adds-expo-sdk-56-support) and [fixed Astro View Transitions styling loss](/release/rel_kxJFtHb2h3qaxhv-Jeg1x-clerk-astro-sdk-clerk-astro-3-3-2-fixes-component-styling-loss-on-view). And [@clerk/shared v3.47.7](/release/rel_9Ajq0e9LgR8rTrE1KO0uB-clerk-shared-v3-47-7-adds-oiat-field-to-jwtheader-for-token-freshness-checks) added an `oiat` field to JWT headers to support monotonic token freshness checks in session minter. ## Releases covered ### Auth0 - [Auth0 Passkeys now supports customizable RPID for cross-subdomain enrollment](https://releases.sh/release/rel_Bh3zBfui-byxePfnCkbBV-passkeys-now-work-across-subdomains-with-custom-rpid) - [Auth0 Token Vault with Organization Support reaches GA](https://releases.sh/release/rel_JbKX4VlYfmZcMQdLXpc5q-token-vault-now-organization-scoped-multi-tenant-isolation-built-in) ### Better Auth - [better-auth v1.6.12 fixes session cookie leak and passkey replay attacks](https://releases.sh/release/rel_mjrK9jVs1_4ayVmf-Qq1g-session-cookie-leak-plugged-passkey-challenges-now-atomic) - [better-auth v1.6.13 fixes XML injection in SAML and OAuth state storage regression](https://releases.sh/release/rel_z5PSaR4FZNUVfQpT1QKwk-saml-xml-injection-patched-oauth-state-storage-fixed) - [better-auth v1.7.0-beta.4 hardens OAuth and OIDC security, fixes resource indicators](https://releases.sh/release/rel_dZsvrOt1qcR7SvCkZyPxj-rfc-8707-resource-indicators-bound-to-authorization-grant-oauth-security) ### Clerk - [Clerk Email Logs public beta enables dashboard email debugging](https://releases.sh/release/rel_hHKhlhSI_ocb24j_Y0YRn-email-logs-now-in-public-beta-inspect-delivery-from-dashboard) - [Clerk JavaScript SDK v6.13.0 displays SSO section in OrganizationProfile](https://releases.sh/release/rel_y9eJXNawoaxGfSYwObGL2-organizationprofile-shows-sso-section-when-enabled) - [Clerk JavaScript SDK @clerk/ui@1.14.0 migrates to new icon set and adds SSO section](https://releases.sh/release/rel_a5YiJMVWpzxdq5xc_Clau-icon-set-migrated-for-consistency-sso-section-added-to-organizationprofile) - [Clerk JavaScript SDK @clerk/localizations@4.7.0 adds SSO section to OrganizationProfile](https://releases.sh/release/rel_QCk3GRl0UvN2Xg8EmcZTM-organizationprofile-shows-sso-section-when-enabled-five-language-packs-completed) - [Clerk JavaScript SDK @clerk/expo@3.3.0 adds Expo SDK 56 support](https://releases.sh/release/rel_kdmOUoaFZA7Dt8SLbNr1d-expo-sdk-56-now-supported) - [Clerk Astro SDK @clerk/astro@3.3.2 fixes component styling loss on View Transitions](https://releases.sh/release/rel_kxJFtHb2h3qaxhv-Jeg1x-component-styling-no-longer-lost-after-view-transitions) - [@clerk/shared v3.47.7 adds oiat field to JwtHeader for token freshness checks](https://releases.sh/release/rel_9Ajq0e9LgR8rTrE1KO0uB-jwtheader-now-includes-oiat-field-for-monotonic-token-freshness)