diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9265a97..d0405f7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,14 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
 
+## [2.3.5] - 2026-09-11
+
+### Security
+
+- [#356](https://github.com/owncloud/openidconnect/pull/356) - fix: verify token audience to prevent cross-client account takeover
+- [#365](https://github.com/owncloud/openidconnect/pull/365) - fix: verify token audience for introspected opaque tokens
+
+
 ## [2.3.4] - 2026-08-21
 
 ### Security
diff --git a/appinfo/info.xml b/appinfo/info.xml
index 8fe93ad..44a890b 100755
--- a/appinfo/info.xml
+++ b/appinfo/info.xml
@@ -19,7 +19,7 @@ The integration requires an Identity Provider that supports OpenID Connect (e.g.
 More information on setup, configuration and migration can be found in the ownCloud Documentation.</description>
     <licence>GPLv2</licence>
     <author>Thomas Müller</author>
-    <version>2.3.4</version>
+    <version>2.3.5</version>
     <namespace>OpenIdConnect</namespace>
     <category>integration</category>
     <documentation>