Issues

• [Detail Bug] API: DPoP requests with non-DPoP-bound tokens return inconsistent error codes between /v1/* and /oauth/userinfo

  bug
  vouch-sh/vouch#1734 · Filter by author detail-app opened on Oct 2, 2026

• [Detail Bug] OIDC DCR: /oauth/register returns duplicate WWW-Authenticate (Bearer + DPoP) on DPoP failures

  bug
  vouch-sh/vouch#1733 · Filter by author detail-app opened on Oct 2, 2026

• [Detail Bug] CLI: Setting VOUCH_GIT_REMOTE_CODECOMMIT=1 hijacks all vouch subcommands into CodeCommit remote-helper mode

  bug
  vouch-sh/vouch#1719 · Filter by author detail-app opened on Oct 2, 2026

• [Detail Bug] CLI: vouch aws console silently ignores --idc-application unless --account is provided

  bug
  vouch-sh/vouch#1718 · Filter by author detail-app opened on Oct 2, 2026

• [Detail Bug] AWS setup wizard accepts Identity Center instance ARN as application ARN, causing misleading token errors and persistent bad config

  bug
  vouch-sh/vouch#1717 · Filter by author detail-app opened on Oct 2, 2026

• [Detail Bug] OAuth app management web UI swallows ownership read errors as “not found” and emits no logs

  bug
  vouch-sh/vouch#1716 · Filter by author detail-app opened on Oct 2, 2026

• [Detail Bug] SAML: Assertions with multiple AudienceRestriction elements are incorrectly accepted when a later restriction excludes this SP

  bug
  vouch-sh/vouch#1715 · Filter by author detail-app opened on Oct 2, 2026

• [Detail Bug] Admin subdomain claim can falsely succeed during concurrent release, creating incorrect audit event

  bug
  vouch-sh/vouch#1714 · Filter by author detail-app opened on Oct 2, 2026

• [Detail Bug] OIDC PAR: requests with JAR dpop_jkt are wrongly rejected when form-body dpop_jkt conflicts

  bug
  vouch-sh/vouch#1713 · Filter by author detail-app opened on Oct 2, 2026

• [Detail Bug] SAML ACS error pages bypass i18n and always render English title/message

  bug
  vouch-sh/vouch#1712 · Filter by author detail-app opened on Oct 2, 2026

• [Detail Bug] HTTP signature verification accepts empty body without validating signed Content-Digest (body-strip attack)

  bug
  vouch-sh/vouch#1711 · Filter by author detail-app opened on Oct 2, 2026

• [Detail Bug] OIDC dynamic client registration responses omit application_type, hiding PKCE requirement for native clients with secrets

  bug
  vouch-sh/vouch#1710 · Filter by author detail-app opened on Oct 2, 2026

• [Detail Bug] SCIM list pagination can return duplicate/missing results for equality filters due to nondeterministic ordering

  bug
  vouch-sh/vouch#1709 · Filter by author detail-app opened on Oct 2, 2026

• [Detail Bug] CLI: vouch exec/env --type redshift bypasses agent credential cache and always refetches

  bug
  vouch-sh/vouch#1708 · Filter by author detail-app opened on Oct 2, 2026

• [Detail Bug] AWS OIDC: client-controlled DPoP source claim becomes server-signed vouch:Agent principal tag (conditional privilege escalation)

  bug
  vouch-sh/vouch#1707 · Filter by author detail-app opened on Oct 2, 2026

• [Detail Bug] Console FAPI 2.0 upgrade rejects valid ES256 inline JWKS when client was previously pinned to RS256

  bug
  vouch-sh/vouch#1706 · Filter by author detail-app opened on Oct 2, 2026

• [Detail Bug] CLI RDS credentials infer wrong AWS region from custom hostnames containing an "rds" label

  bug
  vouch-sh/vouch#1705 · Filter by author detail-app opened on Oct 2, 2026

• [Detail Bug] OIDC: Released org can recreate "Next" signing key via stale-org resolve, causing post-reclaim rotate to promote unpublised kid

  bug
  vouch-sh/vouch#1704 · Filter by author detail-app opened on Oct 2, 2026

• [Detail Bug] Admin UI: deactivation/removal 500s after access revocation omit canonical audit_events entry

  bug
  vouch-sh/vouch#1703 · Filter by author detail-app opened on Oct 2, 2026

• [Detail Bug] OIDC: Clients registered with uppercase-scheme jwks_uri cannot authenticate

  bug
  vouch-sh/vouch#1702 · Filter by author detail-app opened on Oct 2, 2026

• [Detail Bug] Policy validate API preview can disagree with production due to missing posture normalization

  bug
  vouch-sh/vouch#1701 · Filter by author detail-app opened on Oct 2, 2026

• [Detail Bug] OIDC token exchange: ID token requests without audience/resource bypass per-client resource_uris allowlist (aud defaults to issuer)

  bug
  vouch-sh/vouch#1700 · Filter by author detail-app opened on Oct 2, 2026

• [Detail Bug] OIDC key rotation: 'revoke Previous key' gate can open before token expiry when session lifetime is ~1 year+

  bug
  vouch-sh/vouch#1699 · Filter by author detail-app opened on Oct 2, 2026

• [Detail Bug] OAuth/OIDC: Client auth accepts both Basic header and body client_secret in one request (RFC 6749 §2.3)

  bug
  vouch-sh/vouch#1698 · Filter by author detail-app opened on Oct 2, 2026

• [Detail Bug] OIDC authorize (request_uri URN): invalid response_mode is silently defaulted to query on PAR lookup failure

  bug
  vouch-sh/vouch#1697 · Filter by author detail-app opened on Oct 2, 2026