---
schema_version: "1"
id: 85821fa4a76e39dd03b435cadd32ca4a05e3eae1f3115f7e9a1785976af77375
title: OAuth2 Provider Module Release Notes
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/release-notes/connector/oauth2-provider-release-notes.md
canonical_url: https://docs.mulesoft.com/release-notes/connector/oauth2-provider-release-notes
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 41e2e55e618e00fcadba3363aeb1e585e47622d79c69d6bea02a2771ea8e5c78
description: MuleSoft Documentation Site
latest: true
---
---
product: Release Notes
version: master
---

# OAuth2 Provider Module Release Notes

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

The OAuth2 Provider module enables a Mule runtime engine (Mule) app to be configured as an
Authentication Manager in an OAuth2 dance.

Guide: [OAuth2 Provider User Guide](https://docs.mulesoft.com/oauth2-provider-module/latest/)  
Reference: [OAuth2 Provider Reference](https://docs.mulesoft.com/oauth2-provider-module/latest/oauth2-provider-module-reference)

## 1.2.4

**October 22, 2026**

### Compatibility

<table><colgroup><col> <col></colgroup><thead><tr><th>Software</th><th>Version</th></tr></thead><tbody><tr><td><p>Mule</p></td><td><p>4.1.1 and later</p></td></tr><tr><td><p>OpenJDK</p></td><td><p>8, 11, and 17</p></td></tr></tbody></table>

### Fixed Issues

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><p>A custom Spring security provider configured in <strong>Resource Owner Security Provider</strong> now receives the HTTP request headers when it authenticates a resource owner with the <strong>Supported Grant Types</strong> value <code>RESOURCE_OWNER_PASSWORD_CREDENTIALS</code>. Previously, that provider did not receive the request headers. A provider that already sets Spring authentication details keeps those details.</p></td><td><p>W-15615692</p></td></tr><tr><td><p>The module no longer uses the Atlassian-forked <code>spring-security</code> library. The <code>spring-security</code> library is now version 5.8.16-spring-security-5.8.19. The <code>spring-framework</code> library is now version 5.3.39-spring-framework-5.3.45 and is shaded into the module’s Mule plugin.</p></td><td><p>W-23993430</p></td></tr></tbody></table>

## 1.2.3

**July 21, 2026**

### Compatibility

<table><colgroup><col> <col></colgroup><thead><tr><th>Software</th><th>Version</th></tr></thead><tbody><tr><td><p>Mule</p></td><td><p>4.1.1 and later</p></td></tr></tbody></table>

### Fixed Issues

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>These libraries are upgraded to address reported security vulnerabilities:</p></div><div><ul><li><p>The <code>log4j</code> library is upgraded to version 2.26.1 to address CVE-2026-34478.</p></li><li><p>The <code>spring-security</code> library is upgraded to version 5.8.17-atlassian-1.</p></li><li><p>The <code>spring-framework</code> library is upgraded to version 5.3.39-spring-framework-5.3.49.</p></li><li><p>The <code>commons-io</code> library is upgraded to version 2.22.0.</p></li><li><p>The <code>commons-text</code> library is upgraded to version 1.15.0.</p></li><li><p>The <code>gson</code> library is upgraded to version 2.14.0.</p></li><li><p>The <code>apache-velocity</code> library is upgraded to version 2.4.1.</p></li></ul></div></div></td><td><p>W-23274319</p></td></tr></tbody></table>

## 1.2.2

**January 26, 2026**

### Compatibility

<table><colgroup><col> <col></colgroup><thead><tr><th>Software</th><th>Version</th></tr></thead><tbody><tr><td><p>Mule</p></td><td><p>4.1.1 and later</p></td></tr></tbody></table>

### Fixed Issues

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>These libraries are upgraded to address reported security vulnerabilities:</p></div><div><ul><li><p>The <code>commons-collections</code> library is migrated to <code>commons-collections4</code> version 4.5.0 to address sonatype-2024-3350.</p></li><li><p>The <code>commons-lang3</code> library is upgraded to version 3.20.0 to address CVE-2025-48924, and the <code>commons-lang</code> library version 2.6 is excluded to address CVE-2025-48924.</p></li><li><p>The <code>commons-io</code> library is added at version 2.21.0 to override the outdated version in <code>mule-service-http</code> to address CVE-2024-47554.</p></li><li><p>The <code>gson</code> library is upgraded to version 2.13.2 to address CVE-2025-53864.</p></li><li><p>The <code>log4j</code> library is upgraded to version 2.25.3 to address CVE-2025-68161.</p></li><li><p>The <code>spring-core</code> library is upgraded to version 6.2.11 to address CVE-2025-41242 and CVE-2025-41249.</p></li><li><p>The <code>muleHttpConnectorVersion</code> library is upgraded to version 1.10.6.</p></li></ul></div></div></td><td><p>W-20358376</p></td></tr></tbody></table>

## 1.2.1

**September 11, 2025**

### Compatibility

<table><colgroup><col> <col></colgroup><thead><tr><th>Software</th><th>Version</th></tr></thead><tbody><tr><td><p>Mule</p></td><td><p>4.1.1 and later</p></td></tr></tbody></table>

### Fixed Issues

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><p>The Spring framework is upgraded to version 5.3.39-spring-framework-5.3.45 to address reported security vulnerabilities.</p></td><td><p>W-18704894</p></td></tr></tbody></table>

## 1.2.0

**March 26, 2025**

### Compatibility

<table><colgroup><col> <col></colgroup><thead><tr><th>Software</th><th>Version</th></tr></thead><tbody><tr><td><p>Mule</p></td><td><p>4.1.1 and later</p></td></tr></tbody></table>

### Fixed Issues

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><p>This release includes general security fixes.</p></td><td><p>W-16889148</p></td></tr><tr><td><p>The log4j dependency is upgraded to version 2.17.1 to address reported security vulnerabilities.</p></td><td><p>W-16889148</p></td></tr></tbody></table>

## 1.1.0

**May 14, 2024**

### What’s New

This release includes only non-user-impacting changes.

### Compatibility

<table><colgroup><col> <col></colgroup><thead><tr><th>Software</th><th>Version</th></tr></thead><tbody><tr><td><p>Mule</p></td><td><p>4.1.1 and later</p></td></tr><tr><td><p>OpenJDK</p></td><td><p>8, 11, and 17</p></td></tr></tbody></table>

## 1.0.13

**March 8, 2024**

### What’s New

- This connector is now compatible with Java 17.

### Compatibility

<table><colgroup><col> <col></colgroup><thead><tr><th>Software</th><th>Version</th></tr></thead><tbody><tr><td><p>Mule</p></td><td><p>4.1.1 and later</p></td></tr><tr><td><p>OpenJDK</p></td><td><p>8, 11, and 17</p></td></tr></tbody></table>

## 1.0.12

**June 14, 2023**

### Compatibility

<table><colgroup><col> <col></colgroup><thead><tr><th>Software</th><th>Version</th></tr></thead><tbody><tr><td><p>Mule</p></td><td><p>4.1.1 and later</p></td></tr></tbody></table>

### Fixed Issues

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><p>Improved the performance of the <strong>Validate</strong> operation.</p></td><td><p>W-13101424</p></td></tr></tbody></table>

## 1.0.11

**June 12, 2023**

### Compatibility

<table><colgroup><col> <col></colgroup><thead><tr><th>Software</th><th>Version</th></tr></thead><tbody><tr><td><p>Mule</p></td><td><p>4.1.1 and later</p></td></tr></tbody></table>

### Fixed Issues

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><p>Upgraded internal dependencies.</p></td><td><p>W-13568991</p></td></tr><tr><td><p>Refactored code to improve security.</p></td><td><p>W-13145661</p></td></tr></tbody></table>

## 1.0.10

**October 18, 2022**

### Compatibility

<table><colgroup><col> <col></colgroup><thead><tr><th>Software</th><th>Version</th></tr></thead><tbody><tr><td><p>Mule</p></td><td><p>4.1.1 and later</p></td></tr></tbody></table>

### Fixed Issues

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue</th><th>ID</th></tr></thead><tbody><tr><td><p>Upgraded internal dependencies.</p></td><td><p>W-11639029</p></td></tr></tbody></table>

## 1.0.9

**August 23, 2022**

### Compatibility

<table><colgroup><col> <col></colgroup><thead><tr><th>Software</th><th>Version</th></tr></thead><tbody><tr><td><p>Mule</p></td><td><p>4.1.1 and later</p></td></tr></tbody></table>

### Fixed Issues

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue</th><th>ID</th></tr></thead><tbody><tr><td><p>Upgraded internal dependencies.</p></td><td><p>W-11577652</p></td></tr></tbody></table>

## 1.0.8

**December 16, 2021**

### Compatibility

<table><colgroup><col> <col></colgroup><thead><tr><th>Software</th><th>Version</th></tr></thead><tbody><tr><td><p>Mule</p></td><td><p>4.1.1 and later</p></td></tr></tbody></table>

### Fixed Issues

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue</th><th>ID</th></tr></thead><tbody><tr><td><p>Fixed inconsistencies in OAuth2 token expiry time.</p></td><td><p>OPM-31</p></td></tr></tbody></table>

## 1.0.7

**September 24, 2021**

### Fixed Issues

- Added debug logs in the connector to troubleshoot properly. (OPM-29)

## 1.0.6

**February 18, 2021**

### Fixed Issues

- Fixed an issue that prevented LDAP authentication. (OPM-20)

- Fixed the `Already exists a listener matching that path and methods` error that occurred when
  restarting an application using the OAuth2 Provider Module. (OPM-21)

- Fixed the `Provider already registered` error that occurred when starting a stopped application
  when using the OAuth2 Provider Module. (OPM-22)

## 1.0.5

**September 15, 2019**

### Fixed Issues

- `ClassCastException` was incorrectly thrown in an error scenario. This has been replaced by
  `OAuth2ProviderSecurityException`. (MULE-17445)

## 1.0.4

**August 13, 2019**

### Fixed Issues

- HTTP updated to version 1.5.6. (MULE-17254)

- Upgraded commons-io to version 2.6. (MULE-16582)

### Compatibility

The OAuth2 Provider Module is compatible with:

<table><colgroup><col> <col></colgroup><tbody><tr><td><p>Application or Service</p></td><td><p>Version</p></td></tr><tr><td><p>Mule</p></td><td><p>4.1.1 and later</p></td></tr></tbody></table>

## 1.0.3

**January 23, 2019**

### Fixed Issues

- HTTP request parameters are validated twice. (EE-6529)

- Missing default login page files. (EE-6528)

### Compatibility

The OAuth2 Provider Module is compatible with:

<table><colgroup><col> <col></colgroup><tbody><tr><td><p>Application/Service</p></td><td><p>Version</p></td></tr><tr><td><p>Mule</p></td><td><p>4.1.1 and later</p></td></tr></tbody></table>

## 1.0.2

**January 21, 2019**

### Fixed Issues

The OAuth2 Provider Module is compatible with:

<table><colgroup><col> <col></colgroup><tbody><tr><td><p>Application/Service</p></td><td><p>Version</p></td></tr><tr><td><p>Mule</p></td><td><p>4.1.1 and later</p></td></tr></tbody></table>

## 1.0.1

**January 8, 2019**

### Fixed Issues

- Token response content-type header is not application/json (EE-6224)

- ClientCredential grants inconsistent error codes. This broke compatibility, so use system
  property: `mule.oauth.provider.oldErrors=true` if wanting to get the previous error codes.
  (EE-6521)

- `clientSecurityProvider` is no longer mandatory. (EE-6488)

- Static login page is now being exported. (EE-6519)

### Compatibility

The OAuth2 Provider Module is compatible with:

<table><colgroup><col> <col></colgroup><tbody><tr><td><p>Application/Service</p></td><td><p>Version</p></td></tr><tr><td><p>Mule</p></td><td><p>4.1.1 and later</p></td></tr></tbody></table>

## 1.0.0

**June 15, 2018**

### Compatibility

The OAuth2 Provider Module is compatible with:

<table><colgroup><col> <col></colgroup><tbody><tr><td><p>Application/Service</p></td><td><p>Version</p></td></tr><tr><td><p>Mule</p></td><td><p>4.1.1 and later</p></td></tr></tbody></table>

## See Also

- [Salesforce Help](https://help.salesforce.com)

- [MuleSoft Services](https://www.mulesoft.com/support-and-services)

- [Known Issues](https://help.salesforce.com/s/issues)