---
schema_version: "1"
id: 1abb8b45e1fbd3b08b71b71936ca35daa0f03cc67d45060b6557bb1c9403e237
title: OAuth Module Release Notes for Mule 4
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/release-notes/connector/oauth-module-release-notes.md
canonical_url: https://docs.mulesoft.com/release-notes/connector/oauth-module-release-notes
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 8dde843eccdfbfd40d02c9a4961a41db76c87476aef2a96d4d6865bfad3e20d4
description: MuleSoft Documentation Site
latest: true
---
---
product: Release Notes
version: master
---

# OAuth Module Release Notes for Mule 4

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Support Category:
[Select](https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/Agreements/versioning-back-support-policy.pdf)

OAuth Module is an extension to hook OAuth2 to HTTP extension connectors.

Guide: [OAuth Module User Guide](https://docs.mulesoft.com/oauth-module/latest/)

## 1.1.30

**October 19, 2026**

### Compatibility

<table><colgroup><col> <col></colgroup><thead><tr><th>Software</th><th>Version</th></tr></thead><tbody><tr><td><p>Mule</p></td><td><p>4.1.1 and later</p></td></tr><tr><td><p>OpenJDK</p></td><td><p>8, 11, and 17</p></td></tr></tbody></table>

### Fixed Issues

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><p>Client credentials access token and refresh token requests now time out after 60 seconds, instead of waiting indefinitely when the authorization server doesn’t respond.</p></td><td><p>W-24465093</p></td></tr></tbody></table>

## 1.1.29

**September 24, 2026**

### What’s New

- This release includes general security fixes.

### Compatibility

<table><colgroup><col> <col></colgroup><thead><tr><th>Software</th><th>Version</th></tr></thead><tbody><tr><td><p>Mule</p></td><td><p>4.1.1 and later</p></td></tr><tr><td><p>OpenJDK</p></td><td><p>8, 11, and 17</p></td></tr></tbody></table>

## 1.1.28

**August 21, 2026**

### What’s New

- This connector version requires Mule runtime 4.6.22 or later if you’re using Mule 4.6.x, or Mule
  runtime 4.9.9 or later if you’re using Mule 4.9.x. If you prefer not to upgrade your Mule runtime,
  use the connector version released immediately after this one.

### Compatibility

<table><colgroup><col> <col></colgroup><thead><tr><th>Software</th><th>Version</th></tr></thead><tbody><tr><td><p>Mule</p></td><td><p>4.1.1 and later</p></td></tr><tr><td><p>OpenJDK</p></td><td><p>8, 11, and 17</p></td></tr></tbody></table>

## 1.1.27

**May 18, 2026**

### Compatibility

<table><colgroup><col> <col></colgroup><thead><tr><th>Software</th><th>Version</th></tr></thead><tbody><tr><td><p>Mule</p></td><td><p>4.1.1 and later</p></td></tr><tr><td><p>OpenJDK</p></td><td><p>8, 11, and 17</p></td></tr></tbody></table>

### Fixed Issues

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>OAuth Module now enforces a configurable timeout on token-request futures so that stuck or slow authorization-server responses no longer block threads indefinitely. The new <code>mule.oauth.token.request.timeout.millis</code> system property sets the maximum time (in milliseconds) that OAuth Module waits for a token-request future to complete before cancelling it and raising an error.</p></div><div><ul><li><p>Default: <code>60000</code> (60 seconds).</p></li><li><p>Recommended range: 30000–60000 ms. Set higher only if your authorization server is known to be slow.</p></li><li><p>Invalid values (non-numeric, zero, or negative) are ignored with a <code>WARN</code> log, and the default is used.</p></li></ul></div><div><p>Set the property on the worker JVM, for example:</p></div><div><div><pre>-Dmule.oauth.token.request.timeout.millis=45000</pre></div></div><div><p>On CloudHub, add the property as a <strong>Properties</strong> entry on the deployment. No application redeploy of the runtime is needed.</p></div></div></td><td><div><div><p>W-22132137</p></div></div></td></tr></tbody></table>

## 1.1.26

**February 12, 2026**

### Compatibility

<table><colgroup><col> <col></colgroup><thead><tr><th>Software</th><th>Version</th></tr></thead><tbody><tr><td><p>Mule</p></td><td><p>4.1.1 and later</p></td></tr><tr><td><p>OpenJDK</p></td><td><p>8, 11, and 17</p></td></tr></tbody></table>

### Fixed Issues

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>These libraries are upgraded to address CVE-2024-38820:</p></div><div><ul><li><p>The <code>commons-lang3</code> library is upgraded to version 3.20.0.</p></li><li><p>The <code>mule-http-connector</code> library is upgraded to version 1.10.6.</p></li></ul></div></div></td><td><div><div><p>W-19805507</p></div></div></td></tr></tbody></table>

## 1.1.25

**September 8, 2025**

### Compatibility

<table><colgroup><col> <col></colgroup><thead><tr><th>Software</th><th>Version</th></tr></thead><tbody><tr><td><p>Mule</p></td><td><p>4.1.1 and later</p></td></tr><tr><td><p>OpenJDK</p></td><td><p>8, 11, and 17</p></td></tr></tbody></table>

### Fixed Issues

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>Dynamic HTTP requester configurations now properly handle the OAuth dancer lifecycle to prevent race conditions during configuration expiration.</p></div></div></td><td><div><div><p>W-19449357</p></div></div></td></tr></tbody></table>

## 1.1.24

**May 27, 2025**

### Compatibility

<table><colgroup><col> <col></colgroup><thead><tr><th>Software</th><th>Version</th></tr></thead><tbody><tr><td><p>Mule</p></td><td><p>4.1.1 and later</p></td></tr><tr><td><p>OpenJDK</p></td><td><p>8, 11, and 17</p></td></tr></tbody></table>

### Fixed Issues

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>The proxy now works as intended.</p></div></div></td><td><div><div><p>W-18568237</p></div></div></td></tr></tbody></table>

## 1.1.23

**May 8, 2025**

### Compatibility

<table><colgroup><col> <col></colgroup><thead><tr><th>Software</th><th>Version</th></tr></thead><tbody><tr><td><p>Mule</p></td><td><p>4.1.1 and later</p></td></tr><tr><td><p>OpenJDK</p></td><td><p>8, 11, and 17</p></td></tr></tbody></table>

### Fixed Issues

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p><code>NullPointerException</code> errors no longer occur with OAuth authentication when restarting the application intermittently in production.</p></div></div></td><td><div><div><p>W-18230789</p></div></div></td></tr></tbody></table>

## 1.1.22

**February 26, 2025**

### Compatibility

<table><colgroup><col> <col></colgroup><thead><tr><th>Software</th><th>Version</th></tr></thead><tbody><tr><td><p>Mule</p></td><td><p>4.1.1 and later</p></td></tr><tr><td><p>OpenJDK</p></td><td><p>8, 11, and 17</p></td></tr></tbody></table>

### Fixed Issues

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>The commons-io dependency is updated to fix the CVE-2024-47554 vulnerability.</p></div></div></td><td><div><div><p>W-17412056</p></div></div></td></tr><tr><td><div><div><p>A ClassCastException is no longer thrown when using the OAuth Retrieve Access Token operation.</p></div></div></td><td><div><div><p>W-15832018</p></div></div></td></tr></tbody></table>

## 1.1.21

**December 15, 2023**

### What’s New

- This connector is now compatible with Java 17.

### Compatibility

<table><colgroup><col> <col></colgroup><thead><tr><th>Software</th><th>Version</th></tr></thead><tbody><tr><td><p>Mule</p></td><td><p>4.1.1 and later</p></td></tr><tr><td><p>OpenJDK</p></td><td><p>8, 11, and 17</p></td></tr></tbody></table>

## 1.1.20

**May 23, 2023**

### Compatibility

<table><colgroup><col> <col></colgroup><thead><tr><th>Application/Service</th><th>Version</th></tr></thead><tbody><tr><td><p>Mule</p></td><td><p>4.1.1</p></td></tr></tbody></table>

### Fixed Issues

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>The internal libraries are upgraded.</p></div></div></td><td><div><div><p>W-11680326</p></div></div></td></tr><tr><td><div><div><p>The OAuth localCallbackConfig parameter is refactored to avoid different inconsistent behavior according to the configuration order.</p></div></div></td><td><div><div><p>MULE-14827</p></div></div></td></tr></tbody></table>

## 1.1.19

**September 13, 2022**

### Compatibility

<table><colgroup><col> <col></colgroup><thead><tr><th>Application/Service</th><th>Version</th></tr></thead><tbody><tr><td><p>Mule</p></td><td><p>4.1.1</p></td></tr></tbody></table>

### Fixed Issues

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>OAuth module now responds when Token URL fails more than three times.</p></div></div></td><td><div><div><p>W-11680326</p></div></div></td></tr></tbody></table>

## 1.1.18

**March 3, 2022**

### Compatibility

<table><colgroup><col> <col></colgroup><thead><tr><th>Application/Service</th><th>Version</th></tr></thead><tbody><tr><td><p>Mule</p></td><td><p>4.1.1</p></td></tr></tbody></table>

### Fixed Issues

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>Oauth token refresh issue no longer occurs in Mule 4.4.0.</p></div></div></td><td><div><div><p>W-10781856</p></div></div></td></tr></tbody></table>

## 1.1.17

**July 12, 2021**

### Minimum Mule Version

**Mule 4.1.1**

### Fixed Issues

The default object store of `oauth:token-manager-config` is no longer cleared on shut down.
(OAMOD-6)

## 1.1.16

**March 15, 2021**

### Minimum Mule Version

**Mule 4.1.1**

### Fixed Issues

Fixed the `MULE:OVERLOAD` error that occurred concurrently when refreshing the token in dynamic HTTP
configs. (OAMOD-4)

## 1.1.15

**March 2, 2021**

### Minimum Mule Version

**Mule 4.1.1**

### Fixed Issues

In MUnit, the OAuth module creates an object store twice and fails. (OAMOD-2)

## 1.1.14/1.1.13

**September 10, 2020**

### Minimum Mule Version

**Mule 4.1.1**

### Fixed Issues

- Fixed an issue in which using payload in an expression for the refreshTokenWhen property resulted
  in an error. (MULE-18307)

## 1.1.12

**December 19, 2019**

### Minimum Mule Version

**Mule 4.1.1**

### Fixed Issues

Fixed the leak of dynamic configs that resulted from the token manager not initializing in
`AbstractGrantType`. (MULE-17827)

## 1.1.11

**October 18, 2019**

### Minimum Mule Version

**Mule 4.1.1**

### Fixed Issues

- Misnamed parameters in the OAuth module generated invalid extension model. (MULE-17662)

- Upgraded Commons Codec to 1.13. (MULE-17337)

## 1.1.10

**August 13, 2019**

### Minimum Mule Version

**Mule 4.1.1**

### Fixed Issues

- HTTP updated to version 1.5.6. (MULE-17254)

## 1.1.9

**July 18, 2019**

### Minimum Mule Version

**Mule 4.1.1**

### Fixed Issues

- Removed dependencies on MuleContext on OAuth module. (MULE-11412)

- OAuth uses the wrong access token when multiple concurrent refresh requests are sent. (MULE-17010)

## 1.1.8

**April 10, 2019**

### Minimum Mule Version

**Mule 4.1.1**

### Fixed Issues

- OAuth authenticators do not implement equals() and hashCode(). (MULE-16704)

## 1.1.7

**November 2, 2018**

### Minimum Mule Version

**Mule 4.1.1**

### Fixed Issues

- Setting `refreshTokenWhen=true` in oauth:authorization-code-grant-type fails with an exception.
  (MULE-15809)

## 1.1.6

**November 1, 2018**

### Minimum Mule Version

**Mule 4.1.1**

### Fixed Issues

- Support non-blocking in OAuth HTTP calls. (MULE-11272)

- Remove \*-object-store elements (MULE-11724)

## 1.1.5/1.1.4

**August 14, 2018**

### Minimum Mule Version

**Mule 4.1.0**

### Fixed Issues

- OAuth: Provide option `encodeClientCredentialsInBody` in authCode. (MULE-15539)

## 1.1.3

**May 7, 2018**

### Minimum Mule Version

**Mule 4.1.0**

### Fixed Issues

- ConfigurationException: Element 'tokenManagerConfig-MyConfigName' is not defined in the Mule
  Registry. (MULE-14822)

## 1.1.2

**May 7, 2018**

### Minimum Mule Version

**Mule 4.1.0**

### Fixed Issues

- ConfigurationException: Element 'tokenManagerConfig-MyConfigName' is not defined in the Mule
  Registry. (MULE-14822)

## 1.1.1

**January 23, 2018**

### Minimum Mule Version

**Mule 4.1.0**

### Fixed Issues

- Provide a singleton MultiMap instance. (MULE-14544)

## 1.1.0

**January 23, 2018**

### Minimum Mule Version

**Mule 4.1.0**

### Upgrade Requirements

This version does not work with Mule 4.0.0, you need to move to 4.1.0 or a higher version to use it.

### Fixed Issues

- OAuth Module exports internal classes. (MULE-14446)

- Users should not be able to use an expression when configuring a proxy. (MULE-14379)

- HTTP Connector does not route OAuth tokens request through proxy. (MULE-14160)

## 1.0.0

**November 27, 2017**

### Minimum Mule Version

**Mule 4.0.0**

## See Also

- [Salesforce Help](https://help.salesforce.com)

- [MuleSoft Services](https://www.mulesoft.com/support-and-services)

- [Known Issues](https://help.salesforce.com/s/issues)