ory/kratos

View on GitHub

Headless cloud-native authentication and identity management written in Go. Scales to a billion+ users. Replace Homegrown, Auth0, Okta, Firebase with better UX and DX. Passkeys, Social Sign In, OIDC, Magic Link, Multi-Factor Auth, SMS, SAML, TOTP, and more. Runs everywhere, runs best on Ory Network.

Stars: 13.9k
Forks: 1.2k
Open beginner issues: 0
Indexed issues: 149

Dominant language: Go
License: Apache-2.0
Last GitHub push: Jul 29, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: good first issue help wanted
PR merge metrics: No merged PRs in 30d

Beginner friendly Everything

Open All

149 open issues indexed

Expired native Login/Registration use_flow_id loses the session-token exchanger Open

Needs Triage

Difficulty 4/5 3-5 days Newbie friendliness 58/100

ory/kratos#4610 · Opened Sep 18, 2026
transient_payload is not propagated to all settings webhooks Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 66/100

ory/kratos#4609 · Opened Sep 17, 2026
serve.admin.request_log.disable_for_health has no effect (admin prefix added after the request logger) Open

Needs Triage

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

ory/kratos#4605 · Opened Sep 14, 2026
Nil-pointer panic in JWT tokenizer when Jsonnet claims mapper returns non-object `claims` Open

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

ory/kratos#4585 · Opened Jul 23, 2026
Allow updating session information in webhooks Open

feat

Difficulty 5/5 Over a week Newbie friendliness 38/100

ory/kratos#4584 · 2 reactions · Opened Jul 23, 2026
Valid sessions intermittently receive 401s under load Open

bug

Difficulty 5/5 Over a week Newbie friendliness 25/100

ory/kratos#4581 · Opened Jul 3, 2026
Courier service health endpoints Open

feat

Difficulty 3/5 1-2 days Newbie friendliness 58/100

ory/kratos#4579 · Opened Jun 18, 2026
Dependency: pgx v5.9.2 missing auth downgrade protection (CWE-306, fix in v5.10.0) Open

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

ory/kratos#4576 · Opened Jun 14, 2026
Dependency: pgx v5.9.2 vulnerable to auth downgrade (CWE-306, fix in v5.10.0) Open

Difficulty 1/5 1-3 hours Newbie friendliness 72/100

ory/kratos#4573 · Opened Jun 12, 2026
JWKS parsing fails entirely when provider includes ES256K (secp256k1 in Telegram OIDC) Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 52/100

ory/kratos#4572 · 1 reaction · Opened Jun 12, 2026
YugabyteDB support Open

feat

Difficulty 4/5 3-5 days Newbie friendliness 45/100

ory/kratos#4563 · Opened May 3, 2026
Security hardening follow-ups from Kratos scan Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

ory/kratos#4557 · Opened Apr 8, 2026
Support Custom Subject Mapping via Webhook for OAuth2 Flows Open

feat

Difficulty 5/5 Over a week Newbie friendliness 35/100

ory/kratos#4553 · Opened Mar 26, 2026
Passkey ≠ platform attachment Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

ory/kratos#4552 · 1 comment · Opened Mar 25, 2026
Altcha ("Alternative CAPTCHA") support Open

feat

Difficulty 5/5 Over a week Newbie friendliness 32/100

ory/kratos#4549 · Opened Mar 19, 2026
RequestURL returns incorrect URL behind reverse proxy with stripped path prefixes Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 38/100

ory/kratos#4548 · Opened Mar 12, 2026
Respect `return_to` URL in OIDC callback error Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 45/100

ory/kratos#4547 · Opened Mar 12, 2026
Support validating credentials directly in admin API outside of self-service API Open

feat

Difficulty 5/5 Over a week Newbie friendliness 20/100

ory/kratos#4538 · 1 reaction · Opened Feb 20, 2026
feat: Add use_oidc_discovery_issuer option for generic OIDC provider (Azure AD B2C support) Open

Difficulty 3/5 1-2 days Newbie friendliness 25/100

ory/kratos#4536 · Opened Feb 11, 2026
Session Token Rotation Open

feat

Difficulty 5/5 Over a week Newbie friendliness 25/100

ory/kratos#4530 · 1 comment · Opened Jan 23, 2026
feat: allow using external_id as the subject in OAuth2 login flows Open

feat

Difficulty 4/5 3-5 days Newbie friendliness 45/100

ory/kratos#4528 · 1 reaction · Opened Jan 23, 2026
NET Client (NuGet 1.20.11) fails to deserialize sessions with passkey authentication method Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 45/100

ory/kratos#4526 · 1 reaction · Opened Jan 21, 2026
Prevent Account enumeration in passwordless email login (method: code) Open

feat

Difficulty 5/5 Over a week Newbie friendliness 35/100

ory/kratos#4521 · 2 comments · 4 reactions · Opened Jan 14, 2026
Bug: WebAuthn `user_handle` is overwritten during Settings flow, breaking existing credentials Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 48/100

ory/kratos#4519 · Opened Jan 13, 2026
Recovery flow returns 403 CSRF error instead of 410 Gone when max submissions exceeded Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 48/100

ory/kratos#4510 · Opened Dec 12, 2025
Add experimental support for TiDB Open

feat

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ory/kratos#4505 · 3 reactions · Opened Nov 25, 2025
Cleartext SMTP doesn't work Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 35/100

ory/kratos#4498 · 1 reaction · Opened Nov 9, 2025
if update profile with wrong email, user will lost the account Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ory/kratos#4492 · Opened Nov 2, 2025
Phone number for 2FA should not be considered as identifier Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 45/100

ory/kratos#4488 · Opened Oct 22, 2025
Error 500 when authenticating with Hydra OIDC through Kratos Open

bug

Difficulty 5/5 Over a week Newbie friendliness 20/100

ory/kratos#4483 · 1 comment · Opened Oct 18, 2025
Email input validation on sign-in does not exist Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 45/100

ory/kratos#4472 · Opened Sep 25, 2025
Add Logout Action Open

feat stale

Difficulty 5/5 Over a week Newbie friendliness 35/100

ory/kratos#4471 · 1 comment · Opened Sep 18, 2025
Missing Kratos SDK v1.3.1 for JS/TS and Go Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ory/kratos#4464 · Opened Aug 27, 2025
Removing Trait/Phone does not remove phone number from Credential/Code Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 48/100

ory/kratos#4462 · 2 comments · Opened Aug 20, 2025
kratos get identity does not allow to include hashed password Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 45/100

ory/kratos#4460 · Opened Aug 10, 2025
Unified code login and register as one flow Open

feat

Difficulty 5/5 Over a week Newbie friendliness 25/100

ory/kratos#4456 · 1 comment · 3 reactions · Opened Aug 3, 2025
Unable to create identity with recovery address using kratos-client-go Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 20/100

ory/kratos#4454 · 1 reaction · Opened Aug 2, 2025
Go SDK doesn’t handle `UpdateLoginFlow` with `identifier_first` method Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ory/kratos#4453 · Opened Jul 31, 2025
Emails missing the Message-ID header Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 38/100

ory/kratos#4446 · 1 comment · 2 reactions · Opened Jul 3, 2025
Extending a session is not working Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ory/kratos#4441 · 8 comments · 1 reaction · Opened Jun 19, 2025
Allow disabling automatically added verification hook on registration Open

feat

Difficulty 3/5 1-2 days Newbie friendliness 58/100

ory/kratos#4437 · 2 comments · Opened Jun 13, 2025
Errors on network issues with "Have I Been Pwned" call Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 45/100

ory/kratos#4436 · Opened Jun 12, 2025
Unexpected 400 Bad Request response on successful passwordless registration using One-Time Code Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ory/kratos#4432 · 1 comment · 1 reaction · Opened Jun 10, 2025
PUT identity does not update verifiable_addresses Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 35/100

ory/kratos#4426 · 1 comment · Opened Jun 2, 2025
authentication_methods.provider not set on initial linked oidc session Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 48/100

ory/kratos#4417 · Opened May 20, 2025
Hide email input on missing fields during OIDC registration Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 35/100

ory/kratos#4416 · 1 comment · Opened May 15, 2025
Error page vulnerable to "CSRF to Hyperlink Injection" Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ory/kratos#4391 · Opened Apr 23, 2025
Return error on code exchange native OIDC login Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 45/100

ory/kratos#4381 · Opened Apr 15, 2025
Unable to use YubiKey with passkey strategy Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ory/kratos#4377 · 3 comments · 1 reaction · Opened Apr 13, 2025
Hiding an external Provider from Registration and Login flows Open

feat

Difficulty 4/5 3-5 days Newbie friendliness 48/100

ory/kratos#4353 · 3 comments · Opened Mar 20, 2025

ory/kratos

Get new issues in your inbox