SigningHub-v8.6.11-RR-Win64-Accumulative-Patch-30June2026


Improvements

  • Enterprise Branding Consistency During Active Directory Authentication (SHE-61340)
    • SigningHub ensures that enterprise branding is consistently displayed throughout the Active Directory authentication flow. Enterprise branding is reloaded after redirection to the /Next page, resolving an issue where the global branding could temporarily appear during login and logout processes.
  • Improved Radio Button Group Assignment (SHE-61243)
    • SigningHub improves Radio Button group assignment by preventing duplicate group names that could cause assignment conflicts. This reduces delays when creating Radio Button groups across multiple recipients and improves the overall field assignment experience.
  • Consistent Access Security Validation for Workflow Comments (SHE-61150)
    • SigningHub enforces configured document access security controls when accessing Workflow Comments and the Document Comment (Drop-in Comment) field. Access duration restrictions and authentication methods, including Shared Password, OTP, and TOTP, are now applied consistently, preventing unauthorized access to these features.
  • Improved SAML Signature Validation Compatibility (SHE-61173)
    • SigningHub improves SAML authentication compatibility by supporting signature validation for both Response-level and Assertion-level signed SAML responses. This ensures successful authentication with a wider range of Identity Provider (IdP) configurations.


Security Improvement

  • Enhanced Mobile Web Authentication Security (SHE-61415)
    • SigningHub enhances Mobile Web authentication by improving the secure handling of client credentials. Authentication now uses a Client Credentials Access Token mechanism to keep sensitive credentials securely managed on the backend.


SigningHub-v8.6.11-RR-Win64-Accumulative-Patch-25May2026


Improvements

  • Unique Naming for Radio Fields (SHE-61137)
    • Radio fields are now assigned unique randomized field names during creation, ensuring reliable field processing and preventing naming conflicts during delayed network or processing scenarios.
  • Configurable Claim Mapping for Active Directory Authentication (SHE-59319)


    • SigningHub now supports configurable claim mapping for Active Directory authentication, allowing username and user email address retrieval through custom claim names and extension attributes instead of relying solely on the default mail attribute.


Security Improvement

  • Vulnerability Fix
    • The following impacted CVE has been resolved as part of this release:

CVE ID(s)

Severity

Affected Component

Resolution Version

GHSA-35jh-r3h4-6jhm

High

lodash

4.18.1



SigningHub-v8.6.11-DiagnosticPatch-06Mar2026


Improvements

  • Document Locking for Recipient Updates (SHE-59407)
    • Document lock validation has been implemented when updating recipients in pending workflows. If the document is already locked, an error is returned; otherwise, the document is locked before the update to prevent concurrent signing and recipient modification.
  • Improved Azure Active Directory OAuth Authentication Flow (SHE-59903)


    • The OAuth login process for Azure Active Directory has been enhanced to handle edge cases where the authentication pop-up loses its reference to the parent window. A fallback mechanism now ensures that login completes reliably across different browsers and redirect scenarios.


Security Improvement

  • Security Question Field Validation (SHE-59640)
    • The Security Question field now includes enhanced input validation and expression handling, preventing invalid or unsafe entries.


SigningHub-v8.6.11-DiagnosticPatch-07Jan2026


Security Improvement

  • Enhanced Email Security Validation (SHE-58618)
    • SigningHub now enforces stricter email validation to mitigate homograph and impersonation risks. Email addresses using punycode domains or mixed Unicode scripts are no longer permitted.

SigningHub-v8.6.11-DiagnosticPatch-14Nov2025


Improvement

  • API Support for Local Signing (SHE-56690)
    • SigningHub now supports local signing via APIs for Go>Sign and Trust1Connector. This enhancement enables users to perform Sign and Bulk Sign operations directly through the API.


SigningHub-v8.6.11-DiagnosticPatch-12Aug2025


Improvements

  • Enable Swagger Documentation (SHE-53078)
    • SigningHub now provides an EnableSwaggerDocumentation parameter, configurable via the web.config file. When set to false (default) or omitted, Swagger documentation will not be rendered. To view the Swagger documentation, set this parameter to true.
  • Trailing Period in xades:Identifier URI (SHE-54828)
    • Trailing periods have been removed from the xades:Identifier value for certain CommitmentType selections, ensuring the generated XML conforms to the ETSI XAdES standard.
  • Email Delivery in Workflow Sharing (SHE-55277)
    • Email notifications for external recipients in workflow sharing have been updated to allow empty placeholder values during email body processing to prevent exceptions.
  • Parallel Workflow Improvement (SHE-55370)
    • In parallel workflows, the save process now only modifies unassigned or the current signer’s fields, ensuring that existing signers’ data remains intact.
  • Template Radio Button Validation (SHE-55568)
    • Templates now correctly retain changes to radio button validation settings when set to "None." The save process has been updated to ensure all radio buttons in a group preserve their validation state after saving and reopening the template.
  • Bulk Sign via Integration Link (SHE-55681)
    • Bulk signing via Integration Link now works correctly in all session modes, including InProc. The process no longer relies on the isUserIntegration session property, instead using an independent property to ensure consistent pre-validation and signing.
  • About API Response Format (SHE-55411)
    • SigningHub now returns the About API response in JSON format instead of XML, aligning it with the structure of other API responses. Additionally, the default “SigningHub” identifier has been removed to support cleaner and more brand-neutral integrations.


Important System Changes

  • The /about API endpoint now requires a valid client credentials token for access. Integrations that previously accessed this endpoint without authentication must update their implementations to include token-based authentication.
  • The /v4/about API now returns responses in JSON format instead of XML. Integrations relying on the previous XML structure must update their implementations accordingly. Additionally, the default “SigningHub” identifier has been removed from the response.