Evidence record / openhands
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-24-openhands-enterprise-binds-account-linking-to-the-browser-but-makes-email-verification-enforcement
Enterprise binds account linking to the browser but makes email-verification enforcement opt-in. OAuth v2 linking validates a browser-held nonce cookie against link state, with expiry and callback cleanup; a link state alone is no longer sufficient in a different browser. Generic OAuth routes reject non-OAuth providers, while dedicated SAML login, callback and metadata routes ship. Provider configuration gains email-match control. Separately, REQUIRE_VERIFIED_EMAILS now defaults to false because some configured identity providers omit the verification claim and previously locked new users out. Enforcing that middleware condition requires explicit opt-in. This is a changed access default, not evidence of an incident.
Channel: tagged-release. Half: both. Date: 2026-10-19 (1.72.0); 2026-10-20 (1.74.0); 2026-10-21 (1.75.0).
Operator consequence: Upgrade Enterprise separately, review each identity provider’s login, linking and email-match policy, and set REQUIRE_VERIFIED_EMAILS explicitly if verification is part of the deployment’s admission rule. Test both new-user login and cross-browser linking. The release removes provider-specific integration work but makes the administrator responsible for an explicit verification choice. A frontend reconciliation and a further email-match behavior change are in the inspected main range, not 1.79.0; no claim of complete UI parity or hosted rollout follows.
Receipt
- https://github.com/OpenHands/enterprise/commit/87f7fcb30523fa07fd3ff0a7ae29c8e7b473839f
- https://github.com/OpenHands/enterprise/commit/6ce81f28801f3b1072fa0c1224235f134f82fe10
- https://github.com/OpenHands/enterprise/commit/d1df819e9e616f58b629cd92e198018fe31d2bf4
- https://github.com/OpenHands/enterprise/commit/c975ffb5798b0b626bc81239687c15328ca0336a
- https://github.com/OpenHands/enterprise/blob/1.79.0/server/constants.py#L32-L55
- https://github.com/OpenHands/enterprise/blob/1.79.0/server/middleware.py#L87-L104
Finding metadata
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
Finding ID: 2026-10-24-openhands-enterprise-binds-account-linking-to-the-browser-but-makes-email-verification-enforcement
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-24-openhands-enterprise-binds-account-linking-to-the-browser-but-makes-email-verification-enforcementgithub.com/OpenHands/enterprise/commit/87f7fcb30523fa07fd3ff0a7ae29c8e7b473839fcommit2026-10-24-openhands-enterprise-binds-account-linking-to-the-browser-but-makes-email-verification-enforcementgithub.com/OpenHands/enterprise/commit/6ce81f28801f3b1072fa0c1224235f134f82fe10commit2026-10-24-openhands-enterprise-binds-account-linking-to-the-browser-but-makes-email-verification-enforcementgithub.com/OpenHands/enterprise/commit/d1df819e9e616f58b629cd92e198018fe31d2bf4commit2026-10-24-openhands-enterprise-binds-account-linking-to-the-browser-but-makes-email-verification-enforcementgithub.com/OpenHands/enterprise/commit/c975ffb5798b0b626bc81239687c15328ca0336atagged commit file2026-10-24-openhands-enterprise-binds-account-linking-to-the-browser-but-makes-email-verification-enforcementOpenHands/enterprise / server/constants.py#L32-L55tagged commit file2026-10-24-openhands-enterprise-binds-account-linking-to-the-browser-but-makes-email-verification-enforcementOpenHands/enterprise / server/middleware.py#L87-L104
Versioned source: run artifact