Issues

• Passwords can be written to the log by web service actions, REST callouts, LDAP actions and input sanitizing

  pwm-project/pwm#744 · Filter by author mchyzer opened on Oct 14, 2026
  1

• Forgotten password writes a temporary password even when ldap.password.change.self.enable=false

  pwm-project/pwm#742 · Filter by author mchyzer opened on Oct 14, 2026
  1

• Support LDAP Proxy User for Authenticated Change Password.

  pwm-project/pwm#740 · Filter by author mafioletticr0m0-sys opened on Jul 3, 2026

• Password parameters are serialized into redirect URLs (getURLwithQueryString), leaking into logs/history/referer

  pwm-project/pwm#737 · Filter by author mchyzer opened on Jun 4, 2026

• CA_ONLY certificate validation requires importing intermediate CAs; doesn't build a path from a trusted root

  pwm-project/pwm#735 · Filter by author mchyzer opened on Jun 4, 2026

• Outbound HTTPS callouts (OAuth/OIDC, REST, SMS) don't fall back to the JVM default trust store when no certificates are configured

  pwm-project/pwm#733 · Filter by author mchyzer opened on Jun 4, 2026

• Security: Outdated AngularJS versions (v1.8.3 and v1.3.10) in vendor.js bundle - multiple CVEs

  pwm-project/pwm#729 · Filter by author vickzcouto opened on May 19, 2026
  1

• Forgotten password flow: log LDAP errors when proxy-based password change fails

  pwm-project/pwm#728 · Filter by author nathanaelries opened on Mar 30, 2026

• Onejar/Docker deploys two Tomcat contexts (ROOT + /pwm) causing LocalDB read-only mode and service degradation

  pwm-project/pwm#727 · Filter by author nathanaelries opened on Mar 30, 2026

• Config editor saves unchecked boolean settings as <default/> instead of <value>false</value>

  pwm-project/pwm#726 · Filter by author nathanaelries opened on Mar 30, 2026

• Add login_hint parameter to OAuth profile configurations in SSO and Forgotten Password

  pwm-project/pwm#723 · Filter by author haydenconley opened on Jan 8, 2026
  2

• Misleading Dialog Button in Password Reset

  pwm-project/pwm#722 · Filter by author ahpooch opened on Dec 9, 2025

• Undesired change in behavior of Help Desk random password generation after upgrade to 2.0.8

  pwm-project/pwm#720 · Filter by author ahpooch opened on Sep 1, 2025

• Cannot use an E-Mail address with an underscore, "Email Address has invalid characters", despite being in-spec for E-Mail/DNS

  pwm-project/pwm#719 · Filter by author BloodyIron opened on Aug 23, 2025
  1

• "UnsupportedOperationException: Read Only" in Jetty 12

  pwm-project/pwm#716 · Filter by author ThrawnCA opened on Jun 10, 2025
  4

• Add attribute schema (ldif) for the 389 Directory server (FreeIPA)

  enhancement
  pwm-project/pwm#709 · Filter by author itreers opened on Sep 23, 2024

• DUO integration for login and for Forgotten Password

  enhancement
  pwm-project/pwm#705 · Filter by author jcombs-pointblue opened on Nov 21, 2023
  2

• forgottenpassword API throws a NullPointerException after the second request

  pwm-project/pwm#704 · Filter by author tothf opened on Sep 21, 2023
  3

• attribut "AllowNonAlpha" not readable at NetIQeDirectory with NMAS Respones enabled in Versions >2.0

  pwm-project/pwm#702 · Filter by author mtsadminhki opened on Jul 12, 2023

• Allow TLS key pair to be sourced at runtime from a Kubernetes secret

  pwm-project/pwm#700 · Filter by author klasen opened on May 3, 2023
  5

• Create a phone book using People Search

  enhancement
  pwm-project/pwm#698 · Filter by author it-neor opened on Mar 9, 2023
  2

• Email HTML - request URL path segment contains illegal characters

  pwm-project/pwm#697 · Filter by author blissjoe opened on Mar 6, 2023
  9

• Ability to add a counter in LDAP search results

  pwm-project/pwm#692 · Filter by author elizabethsantanderx opened on Feb 12, 2023
  2

• LDAP Data escape during helpdesk/peoplesearch advanced searches.

  pwm-project/pwm#690 · Filter by author jrivard opened on Feb 10, 2023

• INVALID_FORMID issues when using Safari + LastPass MacOS OR Chrome + Google voice

  pwm-project/pwm#673 · Filter by author Sillymak opened on Oct 4, 2022
  3