Token Vault changelog
Subscribe to get automatic updates:
Token Vault 4.2.3
October 26, 2026 patch
Fixed
-
Fixed an issue where authorization server request URLs were taken from the calling page’s request, so the target of a relayed request could be changed by the calling page. The Token Vault Proxy now composes request URLs from its own configuration.
The Token Vault Proxy now relays requests to the
sessionsendpoint, so SSO logout continues to complete as before, and requests to resource server endpoints with names similar to PingAM or PingOne Advanced Identity Cloud endpoints continue to be allowed, with the access token sent only in the authorization header.
Token Vault 4.2.2
May 6, 2026 patch
Updated
-
Updated dependency on Ping (ForgeRock) SDK for JavaScript to version 4.9.1.
Token Vault 4.2.1
March 11, 2026 patch
Updated
-
Updated
evaluateUrlForInterceptionto prevent URL allowlist bypass using query parameter injections.