Issues

• RFC: Atomic existing-user-only authentication for Web3 sign-in

  supabase/auth#2915 · Filter by author RxVince opened on Nov 8, 2026

• Default email template is served for 10 minutes after one failed template fetch

  supabase/auth#2910 · Filter by author mansur-akhmadi opened on Nov 6, 2026

• Passkey sign-in: option to require user verification

  supabase/auth#2907 · Filter by author loekj opened on Nov 5, 2026

• timeoutMiddleware drops the handler's panic stack, so logged panics always point at middleware.go

  supabase/auth#2904 · Filter by author mansur-akhmadi opened on Nov 5, 2026
  1

• Possible regression: /otp, /resend and /reauthenticate never return the SMS provider's message_id for a real provider

  Bug

  supabase/auth#2901 · Filter by author QuintinWillison opened on Nov 4, 2026
  1

• Custom OIDC discovery override blocked by canonical issuer DNS; cold native ID-token flow does not pass override

  supabase/auth#2899 · Filter by author wccheung11011001 opened on Nov 4, 2026

• Migrating from twitter (OAuth 1.0a) to x (OAuth 2.0) creates duplicate users when the X account email has changed

  bug
  supabase/auth#2892 · Filter by author noname241198 opened on Oct 28, 2026
  3

• [Auth] TOTP unenroll commits before notification timeout; gateway retry returns factor-not-found

  supabase/auth#2888 · Filter by author storesmarthaven-source opened on Oct 25, 2026
  3

• TOTP MFA: an already-accepted code is accepted again on a new challenge within the same time step (RFC 6238 §5.2)

  supabase/auth#2882 · Filter by author FilipeGCB opened on Oct 21, 2026

• OAuth 2.1 server: OAuth client access tokens can call /user and /factors (modify user, enroll MFA)

  supabase/auth#2877 · Filter by author antonovicsgergely opened on Oct 17, 2026
  2

• TOTP enrollment returns 500 for phone-only users (empty TOTP account name)

  supabase/auth#2872 · Filter by author emiliosandoval4 opened on Oct 14, 2026

• Hosted project: revoked refresh tokens are never deleted (DB cleanup appears not to run)

  supabase/auth#2870 · Filter by author harveenatwal opened on Oct 13, 2026

• openapi.yaml seems to drift from the admin handlers in several places

  supabase/auth#2859 · Filter by author QuintinWillison opened on Oct 7, 2026
  3

• MFA challenge returns 500 when two factors are challenged at the same instant (unique constraint on mfa_factors.last_challenged_at)

  supabase/auth#2854 · Filter by author peytonhobson opened on Oct 6, 2026

• Postgres-function hooks given a non-transactional connection run set local statement_timeout outside a transaction: timeout not enforced, 25P01 logged (before_user_created, after_user_created, MFA send_sms)

  supabase/auth#2852 · Filter by author aerotech-vadb opened on Oct 6, 2026
  1

• OAuth 2.1 server: support Client ID Metadata Documents (URL client_id) for MCP clients

  supabase/auth#2850 · Filter by author alana-datum opened on Oct 2, 2026
  1

• Steam sign-in: would a first-party provider be considered? (OpenID 2.0 + Steamworks session tickets)

  supabase/auth#2849 · Filter by author SasoriOlkof opened on Oct 2, 2026

• updateUser({email}) fails with "Email address \"\" is invalid" when linking an email to an anonymous user with no prior email

  supabase/auth#2847 · Filter by author lh-lena opened on Oct 1, 2026

• Admin generate_link strips the path from options.redirect_to, always returns origin-only

  supabase/auth#2839 · Filter by author kenlyle2 opened on Sep 28, 2026
  1

• OAuth 2.1 server: no way to require MFA (aal2) for OAuth client access tokens

  bug
  supabase/auth#2838 · Filter by author jhurleyai opened on Sep 28, 2026

• Document what a passkey session's access token contains (amr, aal, timestamp): needed for step-up auth

  documentation
  supabase/auth#2832 · Filter by author GitHubTracey opened on Sep 25, 2026
  1

• Unset GOTRUE_DB_MAX_IDLE_POOL_SIZE disables connection reuse since #2177, exhausting ephemeral ports under load

  supabase/auth#2831 · Filter by author fabianoxyz opened on Sep 24, 2026

• OAuth token endpoint returns non-standard error for missing refresh token

  supabase/auth#2829 · Filter by author fedster99 opened on Sep 23, 2026
  2

• GoTrue rejects valid ES256 tokens after signing-key rotation due to JWKS cache not refreshing at runtime

  supabase/auth#2821 · Filter by author Lihini-KP opened on Sep 21, 2026

• OAuth 2.1 Server (beta): GET /oauth/authorizations/{id} returns 400 when resource, offline_access, or a public client is used — blocks MCP connectors

  supabase/auth#2820 · Filter by author maiconbatistaaa opened on Sep 20, 2026
  1