> ## Documentation Index
> Fetch the complete documentation index at: https://tyk.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Tyk Identity Broker Release Notes

> Release notes documenting updates, enhancements, and changes for Tyk Identity Broker.

****Open Source** ([Mozilla Public License](https://github.com/TykTechnologies/tyk/blob/master/LICENSE.md))**

**This page contains all release notes for Tyk Identity Broker displayed in reverse chronological order**

## Support Lifetime

Only the most recent Tyk Identity Broker release is supported. We recommend staying current to minimise exposure to security vulnerabilities from third party dependencies.

***

## 1.7 Release Notes

### 1.7.3 Release Notes

#### Release Date 23 June 2026

#### Release Highlights

In this patch, we have fixed an issue where Tyk Identity Broker (TIB) did not honor the host application's configured log verbosity when embedded in Tyk Dashboard or Tyk Developer Portal. We have also resolved several CVEs to strengthen security.

For a comprehensive list of changes, please refer to the detailed [changelog](/nightly/#Changelog-v1.7.3) below.

#### Breaking Changes

This release has no breaking changes.

#### Dependencies

##### 3rd Party Dependencies & Tools

| Third Party Dependency                                    | Tested Versions | Compatible Versions       |
| :-------------------------------------------------------- | :-------------- | :------------------------ |
| [GoLang](https://go.dev/dl/)                              | 1.25            | 1.25                      |
| [MongoDB](https://www.mongodb.com/try/download/community) | 5.x, 6.x, 7.0   | 4.4.x, 5.x, 6.x and 7.0.x |
| [Redis](https://redis.io/download/)                       | 6.x - 7.0       | 6.x - 7.0                 |

Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.

#### Deprecations

There are no deprecations in this release.

#### Upgrade instructions

For users currently on v1.7.2, we strongly recommend promptly upgrading to the latest release. If you are working with an older version (lower major), it is advisable to bypass version 1.7.2 and proceed directly to this latest patch release.

<br />

Go to the [Upgrading Tyk](/nightly/#upgrading-tyk) section for detailed upgrade Instructions.

#### Downloads

* [Docker image to pull](https://hub.docker.com/r/tykio/tyk-identity-broker/tags?name=1.7.3)
  ```
  docker pull tykio/tyk-identity-broker:v1.7.3
  ```
* source code tarball for oss projects - [TIB v1.7.3](https://github.com/TykTechnologies/tyk-identity-broker/releases/tag/v1.7.3)

#### Changelog

<a id="Changelog-v1.7.3" data-scroll-offset />

##### Fixed

<AccordionGroup>
  <Accordion title="Inherit Log Verbosity When Embedded">
    When Embedded in Tyk Dashboard or Tyk Developer Portal, TIB now inherits the host application's configured application log verbosity.

    Previously, TIB emitted its log output at a fixed verbosity regardless of the Dashboard or Portal setting, so TIB messages could appear even when the Dashboard was configured to a less verbose level.
  </Accordion>
</AccordionGroup>

##### Security Fixes

<AccordionGroup>
  <Accordion title="Resolved CVEs">
    Addressed the following CVEs, providing increased protection against security
    vulnerabilities, including, but not limited to:

    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39830" target="_blank">CVE-2026-39830</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39831" target="_blank">CVE-2026-39831</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39833" target="_blank">CVE-2026-39833</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42508" target="_blank">CVE-2026-42508</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46595" target="_blank">CVE-2026-46595</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39821" target="_blank">CVE-2026-39821</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39829" target="_blank">CVE-2026-39829</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42504" target="_blank">CVE-2026-42504</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39832" target="_blank">CVE-2026-39832</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39834" target="_blank">CVE-2026-39834</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46597" target="_blank">CVE-2026-46597</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25680" target="_blank">CVE-2026-25680</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25681" target="_blank">CVE-2026-25681</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27136" target="_blank">CVE-2026-27136</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39827" target="_blank">CVE-2026-39827</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39828" target="_blank">CVE-2026-39828</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39835" target="_blank">CVE-2026-39835</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42502" target="_blank">CVE-2026-42502</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42506" target="_blank">CVE-2026-42506</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46598" target="_blank">CVE-2026-46598</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42507" target="_blank">CVE-2026-42507</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27145" target="_blank">CVE-2026-27145</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39824" target="_blank">CVE-2026-39824</a>
  </Accordion>
</AccordionGroup>

### 1.7.2 Release Notes

#### Release Date 19 May 2026

#### Release Highlights

In this release, we have addressed CVEs to strengthen security.

For a comprehensive list of changes, please refer to the detailed [changelog](/nightly/#Changelog-v1.7.2) below.

#### Breaking Changes

This release has no breaking changes.

#### Dependencies

##### 3rd Party Dependencies & Tools

| Third Party Dependency                                    | Tested Versions | Compatible Versions       |
| :-------------------------------------------------------- | :-------------- | :------------------------ |
| [GoLang](https://go.dev/dl/)                              | 1.25            | 1.25                      |
| [MongoDB](https://www.mongodb.com/try/download/community) | 5.x, 6.x, 7.0   | 4.4.x, 5.x, 6.x and 7.0.x |
| [Redis](https://redis.io/download/)                       | 6.x - 7.0       | 6.x - 7.0                 |

Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.

#### Deprecations

There are no deprecations in this release.

#### Upgrade instructions

For users currently on v1.7.1, we strongly recommend promptly upgrading to the latest release. If you are working with an older version (lower major), it is advisable to bypass version 1.7.1 and proceed directly to this latest patch release.

<br />

Go to the [Upgrading Tyk](/nightly/#upgrading-tyk) section for detailed upgrade Instructions.

#### Downloads

* [Docker image to pull](https://hub.docker.com/r/tykio/tyk-identity-broker/tags?name=1.7.2)
  ```
  docker pull tykio/tyk-identity-broker:v1.7.2
  ```
* source code tarball for oss projects - [TIB v1.7.2](https://github.com/TykTechnologies/tyk-identity-broker/releases/tag/v1.7.2)

#### Changelog

<a id="Changelog-v1.7.2" data-scroll-offset />

##### Security Fixes

<AccordionGroup>
  <Accordion title="CVE fixed">
    Addressed the following CVEs, providing increased protection against security
    vulnerabilities, including, but not limited to:

    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33811" target="_blank">CVE-2026-33811</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33814" target="_blank">CVE-2026-33814</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39820" target="_blank">CVE-2026-39820</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39836" target="_blank">CVE-2026-39836</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42499" target="_blank">CVE-2026-42499</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32952" target="_blank">CVE-2026-32952</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39823" target="_blank">CVE-2026-39823</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39826" target="_blank">CVE-2026-39826</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39825" target="_blank">CVE-2026-39825</a>
  </Accordion>
</AccordionGroup>

### 1.7.1 Release Notes

#### Release Date 20th April 2026

#### Release Highlights

In this release, we have updated Tyk Identity Broker (TIB) to Golang 1.25 for enhanced security and performance.

For a comprehensive list of changes, please refer to the detailed [changelog](/nightly/#Changelog-v1.7.1) below.

#### Breaking Changes

This release has no breaking changes.

#### Dependencies

##### 3rd Party Dependencies & Tools

| Third Party Dependency                                    | Tested Versions | Compatible Versions       |
| :-------------------------------------------------------- | :-------------- | :------------------------ |
| [GoLang](https://go.dev/dl/)                              | 1.25            | 1.25                      |
| [MongoDB](https://www.mongodb.com/try/download/community) | 5.x, 6.x, 7.0   | 4.4.x, 5.x, 6.x and 7.0.x |
| [Redis](https://redis.io/download/)                       | 6.x - 7.0       | 6.x - 7.0                 |

Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.

#### Deprecations

There are no deprecations in this release.

#### Upgrade instructions

For users currently on v1.7.0, we strongly recommend promptly upgrading to the latest release. If you are working with an older version (lower major), it is advisable to bypass version 1.7.0 and proceed directly to this latest patch release.

<br />

Go to the [Upgrading Tyk](/nightly/#upgrading-tyk) section for detailed upgrade Instructions.

#### Downloads

* [Docker image to pull](https://hub.docker.com/r/tykio/tyk-identity-broker/tags?name=1.7.1)
  ```
  docker pull tykio/tyk-identity-broker:v1.7.1
  ```
* source code tarball for oss projects - [TIB v1.7.1](https://github.com/TykTechnologies/tyk-identity-broker/releases/tag/v1.7.1)

#### Changelog

<a id="Changelog-v1.7.1" data-scroll-offset />

##### Changed

<AccordionGroup>
  <Accordion title="Updated Go version to 1.25">
    The Tyk Identity Broker (TIB) has been updated to Golang 1.25, improving security by staying up-to-date with Go versions.
  </Accordion>
</AccordionGroup>

##### Security Fixes

<AccordionGroup>
  <Accordion title="CVE fixed">
    Addressed the following CVEs, providing increased protection against security
    vulnerabilities, including, but not limited to:

    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33186" target="_blank">CVE-2026-33186</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33487" target="_blank">CVE-2026-33487</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32285" target="_blank">CVE-2026-32285</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-22868" target="_blank">CVE-2025-22868</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-30204" target="_blank">CVE-2025-30204</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2024-45338" target="_blank">CVE-2024-45338</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-10543" target="_blank">CVE-2025-10543</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-22870" target="_blank">CVE-2025-22870</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-22872" target="_blank">CVE-2025-22872</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-27144" target="_blank">CVE-2025-27144</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-47911" target="_blank">CVE-2025-47911</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-58181" target="_blank">CVE-2025-58181</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-58190" target="_blank">CVE-2025-58190</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34986" target="_blank">CVE-2026-34986</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39883" target="_blank">CVE-2026-39883</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39882" target="_blank">CVE-2026-39882</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2024-51744" target="_blank">CVE-2024-51744</a>
    * <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-29923" target="_blank">CVE-2025-29923</a>
  </Accordion>
</AccordionGroup>

### 1.7.0 Release Notes

#### Release Date 28 March 2025

#### Release Highlights

This release introduces enhancements to TIB, improving group-based permission mapping, adding support for proxy settings from environment variables, and allowing dynamic state values in the OAuth2 flow.

For a comprehensive list of changes, please refer to the detailed [changelog](/nightly/#Changelog-v1.7.0) below.

#### Breaking Changes

This release has no breaking changes.

#### Dependencies

##### 3rd Party Dependencies & Tools

| Third Party Dependency                                    | Tested Versions | Compatible Versions       | Comments                    |
| :-------------------------------------------------------- | :-------------- | :------------------------ | :-------------------------- |
| [GoLang](https://go.dev/dl/)                              | 1.21            | 1.21                      | All our binaries            |
| [MongoDB](https://www.mongodb.com/try/download/community) | 5.x, 6.x, 7.0   | 4.4.x, 5.x, 6.x and 7.0.x | Used by Tyk Identity Broker |
| [Redis](https://redis.io/download/)                       | 6.x - 7.0       | 6.x - 7.0                 | Used by Tyk Identity Broker |

Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.

#### Deprecations

There are no deprecations in this release.

#### Upgrade instructions

For users currently on v1.6.0, we strongly recommend promptly upgrading to the latest release. If you are working with an older version (lower major), it is advisable to bypass version 1.6.0 and proceed directly to this latest patch release.

<br />

Go to the [Upgrading Tyk](/nightly/#upgrading-tyk) section for detailed upgrade Instructions.

#### Downloads

* [Docker image to pull](https://hub.docker.com/r/tykio/tyk-identity-broker/tags?name=1.7.0)
  ```
  docker pull tykio/tyk-identity-broker:v1.7.0
  ```
* source code tarball for oss projects - [TIB v1.7.0](https://github.com/TykTechnologies/tyk-identity-broker/releases/tag/v1.7.0)

#### Changelog

<a id="Changelog-v1.7.0" data-scroll-offset />

##### Added

<AccordionGroup>
  <Accordion title="Load Proxy Settings from Environment Variables">
    TIB now respects `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` environment variables when making outbound connections. This change ensures compatibility with air-gapped Kubernetes environments where external services can only be accessed via an HTTP proxy.
  </Accordion>

  <Accordion title="Dynamic State Query Support in OAuth2 Flow">
    The OAuth2 "state" field can now be dynamically set via the URL or form-encoded body. This improvement allows integration with external APIs that require custom state values, ensuring compliance with various regulatory and enterprise authentication requirements.
  </Accordion>

  <Accordion title="Improved Multi-Group Permission Mapping for Identity Providers">
    Previously, TIB assigned a user to the last matched group when multiple groups were mapped, regardless of the identity provider (SAML, LDAP, OAuth, OIDC, etc.). The new functionality introduces support for multi-group mapping, allowing permissions to be merged. This update is backward compatible and ensures that multi-group rights (combined permissions) are only applied if the user does not have a `groupId` assigned via the Dashboard.
  </Accordion>
</AccordionGroup>

##### Security Fixes

<Expandable title="Fixed the following CVE">
  * [GHSA-v778-237x](https://github.com/advisories/GHSA-v778-237x-gjrc)
</Expandable>

***

## 1.6 Release Notes

### 1.6.1 Release Notes

#### Release Date 5 Nov 2024

#### Release Highlights

###### Enhanced Security with JWE Support for OIDC SSO

This release introduces JSON Web Encryption (JWE) support for OpenID Connect (OIDC) Single Sign-On (SSO) in the Tyk Identity Broker (TIB). With this enhancement, organizations can achieve greater security for token handling during authentication flows. JWE token validation and processing are now seamlessly integrated, offering configurable private key support for decryption.

#### Breaking Changes

This release has no breaking changes.

{/* ##### Changed error log messages
Important for users who monitor Tyk components using the application logs (i.e. Tyk Gateway log, Tyk Dashboard log, etc.).
We try to avoid making changes to our log messages, especially at error and critical levels. However, sometimes it's necessary. Please find the list of changes made to the application log in this release: */}

{/* ##### Planned Breaking Changes */}

#### Dependencies

##### 3rd Party Dependencies & Tools

| Third Party Dependency                                    | Tested Versions | Compatible Versions       | Comments                    |
| :-------------------------------------------------------- | :-------------- | :------------------------ | :-------------------------- |
| [GoLang](https://go.dev/dl/)                              | 1.21            | 1.21                      | All our binaries            |
| [MongoDB](https://www.mongodb.com/try/download/community) | 5.x, 6.x, 7.0   | 4.4.x, 5.x, 6.x and 7.0.x | Used by Tyk Identity Broker |
| [Redis](https://redis.io/download/)                       | 6.x - 7.0       | 6.x - 7.0                 | Used by Tyk Identity Broker |

Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.

#### Deprecations

There are no deprecations in this release.

{/* ###### Future deprecations */}

#### Upgrade instructions

For users currently on v1.6.0, we strongly recommend promptly upgrading to the latest release. If you are working with an older version (lower major), it is advisable to bypass version 1.6.0 and proceed directly to this latest patch release.

<br />

Go to the [Upgrading Tyk](/nightly/#upgrading-tyk) section for detailed upgrade Instructions.

#### Downloads

* [Docker image to pull](https://hub.docker.com/r/tykio/tyk-identity-broker/tags?name=1.6.1)
  ```
  docker pull tykio/tyk-identity-broker:v1.6.1
  ```
* source code tarball for oss projects - [TIB v1.6.1](https://github.com/TykTechnologies/tyk-identity-broker/releases/tag/v1.6.1)

#### Changelog

##### Added

<Expandable title="Support for JSON Web Encryption (JWE) in OIDC SSO with TIB">
  This release adds support for JSON Web Encryption (JWE) in OIDC Single Sign-On (SSO) with TIB, providing enhanced security for token handling in authentication flows. This feature enables processing and validation of JWE tokens, with configuration options for setting the private key required for decryption.

  For more details, refer to the [OIDC SSO with JWE](/nightly/api-management/single-sign-on-social-idp#json-web-encryption-jwe) documentation.
</Expandable>

***

{/* The footer of the release notes page. It contains a further information section with details of how to upgrade Tyk,
links to API documentation and FAQs. You can copy it from the previous release. */}

## Further Information

### Upgrading Tyk

Please refer to the [upgrading Tyk](/nightly/developer-support/upgrading) page for further guidance on the upgrade strategy.

### FAQ

Please visit our [Developer Support](/nightly/developer-support/community) page for further information relating to reporting bugs, upgrading Tyk, technical support and how to contribute.