Skip navigation

Authentication Proxy - Release Notes

Last updated:

Release notes for recent Authentication Proxy versions.

We encourage all customers to regularly upgrade to the latest Duo Authentication Proxy release to receive feature and security updates.

Product Downloads

Download the current release from the Checksums and Downloads page.

Version 6.8.1 - November 5, 2026

  • A RadSec radius_client now verifies the RadSec server's certificate against ssl_ca_certs_file and the configured host.
  • A RadSec radius_client host can now be a DNS hostname.
  • A RadSec radius_client now sends the nas_ip value (or the Authentication Proxy's own IP address) as NAS-IP-Address (NAS-IPv6-Address for an IPv6 address) on the requests it creates, instead of the RadSec server's address. The Authentication Proxy forwards pass-through requests unchanged.
  • A server section whose heading isn't all lowercase, like [RADIUS_SERVER_AUTO], now uses its own client setting instead of the [main] section client or the only configured client. If that client names a section that isn't configured, the Authentication Proxy now fails to start.
  • An indented section heading that duplicates another heading in a different case (for example, an indented [AD_CLIENT] after [ad_client]) no longer replaces the earlier section. Instead, the Authentication Proxy fails to start because of a duplicate section.
  • The Authentication Proxy now fails to start when an ldap_server_auto section's exempt_ou_* value is blank or isn't a valid DN.
  • With fips_mode=true, an ad_client using auth_type=ntlm2 or auth_type=sspi with transport=clear now fails before the NTLM exchange, and the connectivity tool reports it as an error. This combination isn't supported in FIPS mode.
  • Logs a warning at startup when a server section uses failmode=safe (the default), recommending failmode=secure instead.
  • Logs a warning when a TLS server certificate has no subjectAltName and the Authentication Proxy matches the hostname against its commonName instead. The Authentication Proxy still accepts these certificates for hostnames.
    • Duo will remove support for commonName matching in a future release.
  • RADIUS server sections now drop UDP Access-Request packets that contain an EAP-Message but no Message-Authenticator.
  • Fixes an issue where ldap_server_auto processed LDAP operations a client sent during a bind when a response to a different operation arrived first. ldap_server_auto now drops these operations until the bind's own response arrives, including during an allow_concat retry.
    • With exempt_primary_bind=false, ldap_server_auto now also closes the connection when the client sends an operation other than Bind, Unbind, or Abandon after a bind that the directory accepted but Duo authentication rejected.
  • ldap_server_auto now rejects NTLM binds that require Duo authentication when their character-set flags don't match the negotiated exchange, when their user or domain name can't be decoded, or when their user or domain name contains control characters.
  • The Authentication Proxy now closes LDAP connections when unencrypted data follows a StartTLS exchange or follows an NTLM or SSPI sign-and-seal bind it makes to the directory for ad_client, Directory Sync, or Duo Single Sign-On.
  • Fixes an issue introduced in version 6.6.0 where radius_server_auto EAP pass-through to a RadSec radius_client failed. The Authentication Proxy signed replies to the RADIUS client with the wrong shared secret, so the client discarded them.
  • Fixes an issue where radius_server_auto MS-CHAPv2 logins with a passcode sent the MS-CHAPv2 response to the upstream RADIUS server a second time.
  • Fixes ldap_server_auto memory growth when clients send LDAP operations other than Bind and Search (for example, Compare, Modify, or WhoAmI) on long-lived connections.
  • Upgrades the Authentication Proxy Manager to version 1.3.0 (Electron 45.1.0) to address CVE-2026-111497.

Version 6.8.0 - June 3, 2026

  • Adds certificate analyzer support for RadSec connections, helping diagnose certificate issues for both client (outgoing) and server (incoming mTLS) RadSec configurations.
  • Adds receiving port number to RADIUS "dropping packet" log messages, making it easier to identify which proxy section is dropping traffic in multi-port configurations.
  • Fixes Windows service startup timeout (Error 1053) that could occur when the connectivity tool hangs during service initialization, particularly on VMs and Windows Server 2025.
  • Adds error logging when the cloud proxy identifier cannot be read during startup.
  • Updates various third-party dependencies.

Version 6.7.0 - May 26, 2026

Version 6.6.0 - November 12, 2025

Version 6.5.2 - August 5, 2025

Version 6.5.1 - May 27, 2025

  • Adds support for new Duo certificate authorities.

Version 6.5.0 - April 23, 2025

  • IPv6 support for communicating with other on-premises applications, servers, and devices. Please note that communication with Duo's cloud service will still resolve the API hostname to an IPv4 address.
  • Connections to DNS hostnames will now honor multiple IP addresses and choose the fastest connection.
  • When specifying hostnames in ad_client sections or in the Admin Panel configuration for Duo SSO Active Directory authentication, Active Directory sync, and OpenLDAP sync, the hostnames must be RFC-1034-compliant and:
    • Start with a letter.
    • End with a letter or digit.
    • Only contain letters, digits, or hyphens (-) in the host or domain name.
  • No longer prints ModuleNotFoundError during successful build.
  • Fix logfile rotation when an extra file exists in log directory
  • Improves handling of None values in HTTP client.
  • Add rate-limiting logic for 429 errors.
  • Upgrade Python to 3.11.10 to address multiple CVEs, such as CVE-2024-6923 and CVE-2024-4030.
  • Upgrade to Cryptography 43.01 / OpenSSL 3.3.2 to address CVE-2024-6119.
  • Updates to various third-party dependencies.

Version 6.4.2 - October 21, 2024

  • Adds the configuration option force_message_authenticator to radius_server modules.
    • Set force_message_authenticator to true to force the Authentication Proxy to include a message-authenticator attribute in reply packets.
  • Ensures that reply packets containing a message-authenticator attribute send that as the first attribute.

Version 6.4.1 - May 8, 2024

  • Fixes a resource leak related to failed TLS connections in ldap_server_auto.
  • Please review the information in the 6.4.0 release note. If you experience issues with LDAPS/STARTTLS connections after installing 6.4.1, and your certificate(s) have key lengths less than 2048, see Duo KB article 8866 for a workaround.

Version 6.4.0 - April 30, 2024

  • Fixes unnecessarily strict Connectivity Tool validation of ldap_server_auto SSL certificates.
  • Improves logged error messaging for AD DIR_ERROR responses.
  • The Authentication Proxy Manager now displays additional error information in certain failure scenarios.
  • Updates the internal build process to use scoped package names.
  • Upgrade to Cryptography 42.0.5 / OpenSSL 3.2.1 to address CVE-2024-26130, CVE-2023-50782, and CVE-2024-0727.
    • This version of OpenSSL changes the default SSL/TLS security level from 1 to 2. As a result of the default security level change, certificates with key lengths less than 2048 are no longer acceptable for inbound and outbound SSL, LDAPS, or STARTTLS connections to the Authentication Proxy. Our recommendation is that you reissue your certificates with key lengths of 2048 or greater. If you cannot update your certificates now, a workaround is available. Please see Duo KB article 8866 for details.
  • Upgrade Python to 3.11.9 to address CVE-2023-6597 and CVE-2024-0450.
  • Upgrade OpenSSL FIPS module to 3.0.9 to address CVE-2023-1255.
  • Updates various internal dependencies.

Version 6.3.0 - February 6, 2024

Version 6.2.0 - November 28, 2023

Version 6.1.0 - September 19, 2023

  • Restores the default for allow_concat to false in the radius_server_eap section.
  • Fixes various bugs in radius_server_eap functionality.
  • No longer logs configured server sections twice at startup.
  • Authentication Proxy upgrades no longer fail when there is a subdirectory inside the conf directory.
  • The Windows service now correctly installs/uninstalls when there is an invalid authproxy.cfg.
  • Provides a utility script to assist with converting radius_server_iframe sections to radius_server_auto. See Guide to Duo's iFrame Reconfiguration Script.
  • Updates Cryptography to 41.0.3.
  • Updates OpenSSL to 3.1.2.

Version 6.0.2 - July 24, 2023

  • The value for allow_concat in the radius_server_eap section now correctly defaults to True.
  • The Authentication Proxy connectivity tool and Authentication Proxy Manager now raise an exception if the Authentication Proxy is given a password-protected certificate.
  • Fixed a resource leak related to failed TLS connections.

Version 6.0.1 - June 14, 2023

Version 6.0.0 - June 7, 2023

Versions Before 6.0.0

See the Authentication Proxy Release Notes Archive page.