# Stronger OAuth validation and Aembit Tenant UI sign-in protection

Aembit Cloud now applies stricter checks to OAuth authorization for Credential Providers and to sign-in to the Aembit Tenant UI. Aembit applied these updates to Aembit Cloud for you, so you have nothing to change.

* **Issuer verification** - After a user consents, Aembit Cloud checks that the authorization server’s response comes from the issuer it discovered for the Credential Provider. A response from a different authorization server cannot complete the authorization.
* **OAuth request validation** - Aembit Cloud applies tighter checks to OAuth callbacks and to the authorization server endpoints it calls.
* **Sign-in protection** - The Aembit Tenant UI has stronger protection against repeated failed password sign-ins.
* **Content Security Policy** - The Aembit Tenant UI sends a stricter Content Security Policy, which allows scripts and fonts from fewer outside sources.
* **Container image update** - Aembit Cloud container images include the Debian security update for the published vulnerability `CVE-2026-111497` in the Brotli compression library.