v3.10.4

Released October 21, 2026

Fixes password resets so users can complete them from the emailed reset link.

Confirming this release. A user who requests a password reset can now set a new password directly from the emailed link — the reset page no longer asks for their current password or an MFA code — and a password that doesn’t meet the requirements shows the specific reason. If a reset doesn’t behave this way, confirm your deployment’s version with your Ask Sage administrator.

🔧 Improvements & fixes

• Password reset from the emailed link now works. When a user requested a password reset, the reset page still asked for their current password and an MFA code — which someone who had forgotten their password couldn’t provide — so the reset couldn’t be completed. Reset sessions (both the emailed reset link and an expired‑password sign‑in) now let the user set a new password directly, without the old password or an MFA code.
• Clearer password‑reset errors. If the new password doesn’t meet the complexity or reuse requirements, the page now shows the specific reason instead of a generic failure message.

Normal password changes are unchanged — changing your password while signed in still requires your current password and an MFA code.

🔒 Security & platform

Ask Sage services are delivered as FIPS‑hardened, digest‑pinned, and cosign‑signed images within the FedRAMP Class D authorization boundary, and are continuously rebuilt against the latest patched base images as part of Ask Sage’s continuous‑monitoring commitment.