Release notes

The release notes describe new features, enhancements, and fixes for the ReachFive platform. The latest release notes are found below. For previous releases, check out the sidebar.

For upcoming changes that require your attention, see the Attention page.

Other releases

The following shows other ReachFive releases for your convenience.

SDK repository Latest version Docs

SDK repository	Latest version	Docs
Core SDK		Core SDK
UI SDK		UI SDK
Android SDK	MavenCentral `9.9.0`	Android SDK
iOS SDK		iOS SDK
SFCC Cartridge	SFCC Cartridge `20.8.3`	Salesforce cartridge

identity core

identity ui

MavenCentral 9.9.0

Reach5

SFCC Cartridge 20.8.3

Salesforce cartridge

11 June 2026 (v2.159)

Production ✅

ReachFive v2.159 brings a few new features and updates:

Access Control v2
Additional audit log actions for Pub/Sub hooks

As always, we made some general improvements and fixed a few items for you.

Release highlight

Access Control v2

We are excited to launch Access Control v2, which extends our Attribute-Based Access Control (ABAC) engine with a powerful new capability: Access Token Entitlements.

While the ABAC engine initially focused on blocking or allowing entry to signup and login journeys, this upgrade empowers you to inject dynamic authorization attributes directly into user access tokens at runtime. This bridges the gap between authentication and downstream authorization, allowing your applications to make instant, context-aware access decisions without repetitive API lookups.

With the introduction of Entitlements, the access token becomes a self-contained vehicle for fine-grained authorization.

What’s new?

Dynamic token enrichment: Automatically populate a top-level entitlements claim array with custom authorization attributes (such as roles, classifications, or permissions) mapped from user profile data.
Continuous evaluation: Entitlements are evaluated globally whenever a new access token is generated or refreshed. This includes standard logins, passwordless flows, and third-party authentications.
Dedicated audit trail: Monitor and troubleshoot configurations effortlessly using the new, standalone entitlement_provided user event, which cleanly separates authorization tracking from standard authentication logs.

Immediate Benefits:

Zero extra API overhead: Offload application-level access logic to the token itself. Your downstream services and APIs can inspect the token’s entitlements claim locally to grant rights, eliminating the need to query the ReachFive Identity API post-login.
Real-time security syncing: Because entitlement rules are re-evaluated during token refresh, any modifications to a user’s profile attributes automatically update downstream when their token rotates, ensuring permissions are always accurate.

For more details on this topic, see Attribute-Based Access Control (ABAC).

Additional audit log actions for Pub/Sub hooks

The users:get and users:search actions are now included in the audit logs for Pub/Sub hooks, providing more comprehensive tracking of user profile access and search activities.

Audit log actions for Pub/Sub hooks

For more details, see Audit logs: Create Pub/Sub hook from console.

General improvements

When a user authenticates with a second social provider, we now ensure that the existing email for the user is retained and not overwritten by the new provider’s email, which may be different. The new email is still kept as part of the identities and emails objects.
Provider variants are now included in a user’s recent activity so it’s more clearly visible which provider variant was used for each event.

Fixes

Item Fixed

Item	Fixed
In some limited instances, logins with Paypal Connect were failing unexpectedly.	✓
When using the `/oauth/par` endpoint, against non-existent profiles, the response was a `404`. The response is now a `303` with a query parameter showing the error so the user is redirected accordingly and you can handle the error in your application.	✓
There was temporarily an issue when sorting by `email` when searching for users via the Management API.	✓

In some limited instances, logins with Paypal Connect were failing unexpectedly.

✓

When using the /oauth/par endpoint, against non-existent profiles, the response was a 404. The response is now a 303 with a query parameter showing the error so the user is redirected accordingly and you can handle the error in your application.

✓

There was temporarily an issue when sorting by email when searching for users via the Management API.

✓