SigningHub v10.0.5

May 2026

New Features

Multi-Enterprise Support (SHE-22737)

SigningHub supports users belonging to multiple enterprises with the ability to switch between them during an active session and set a default enterprise for login. Documents, workflows, settings, billing, and quota are applied based on the selected enterprise context.

IDV Integration Enhancement (SHE-51481)

SigningHub introduces integration with Ascertia Digital Identity Verification (IDV), allowing administrators to dynamically configure identity verification providers and policies. IDV policies can be defined at the role level and applied within workflows to enforce recipient-level or field-level verification, ensuring users complete identity verification during document access or signing.

This is a license-based feature.

Artificial Intelligence (AI) Management Enhancement (SHE-58568)

SigningHub introduces enhanced Artificial Intelligence (AI) management capabilities, enabling administrators to configure AI clients and define AI tools for enterprise use. AI configuration is centrally managed through admin-level connectors and clients, while enterprise administrators can control AI access via roles and manage AI tools and clients within their environment.

This is a license-based feature.

---

Improvements

Hand-Drawn Signature and Initials Management (SHE-59735)

SigningHub allows users to create and manage hand-drawn signatures and initials directly from Personal Settings. Once configured, these can be reused during signing, eliminating the need to redraw them each time. Users can choose to use the saved signature or draw a new one within the signing dialogue, providing greater flexibility during signing.

Slider Enhancement (SHE-59060)

SigningHub allows administrators to set all sliders as inactive or remove them entirely in both Admin and Web branding settings. Previously, at least one active slider was required; this restriction has now been removed, enabling full control over slider visibility on the login screen.

SAM Server User Deletion (SHE-59018)

SigningHub provides an option to automatically delete the linked ADSS SAM Server user when a SigningHub user is deleted. When enabled, any associated certificates or keys are also removed, helping ensure accurate key counts and preserve system integrity.

SAM Key Pair Deletion on Certificate Revocation (SHE-58036)

SigningHub introduces an option to delete the associated key pair from the SAM server when a certificate is revoked. When enabled, the associated SAM (ADSS) key is removed upon certificate revocation, ensuring revoked keys are not counted against the user key limit.

Core Thread Scheduling Enhancement (SHE-58037)

SigningHub allows administrators to configure the execution timing of core threads. Each thread’s Frequency and Interval can be set, providing greater control over system operations. All thread timings follow UTC.

Service Plan Quota Alert Configuration (SHE-41173, SHE-51595)

SigningHub introduces configuration options for service plan quota alerts, allowing administrators to define the threshold for triggering quota alerts and the interval for sending reminder notifications.

Document Viewer Sidebar Panel Control (SHE-59505)

SigningHub introduces an integration setting to lock the document viewer’s sidebar panel by default, allowing the right-side panel to be hidden and preventing users from expanding it. This ensures a cleaner, distraction-free document viewing experience within embedded and iframe-based integrations.

Bulk Contacts CSV Template (SHE-59098)

SigningHub provides a .csv template for bulk contacts upload in both the Personal Contacts and Enterprise Contacts sections, improving usability by guiding users on the required data format for successful uploads.

User Count License Alert Threshold (SHE-50040)

SigningHub introduces a license alert setting that sends automated notifications when the remaining user count reaches a configured percentage threshold.

Role-Based Validation for Signature Appearance Designs (SHE-59879)

Validation for Signature Appearance Designs has been improved to align with role-based permissions. If a previously configured default signature appearance becomes unavailable, the system now ignores the disabled default and displays only the signature appearance options permitted for the user’s role, ensuring the signing dialogue opens without errors.

Scope Token Security Enhancement (SHE-60440)

SigningHub introduces an option to enable or disable scope token usage within integration applications, supporting a least-privilege security approach. When disabled, all scope-based configurations and related actions, including token generation and APIs, are hidden and restricted.

Pending Invitations Enhancement (SHE-59749)

SigningHub has updated the handling of pending invitations across web and mobile platforms. The invitation dialogue has been removed from the login flow and is now shown after login via a notification indicator.

Document Listing Status Filter Enhancement (SHE-59577)

SigningHub refines the status filters on the document listing screen by separating the previously combined “Action Required” category into individual “Pending” and “Declined” filters. This enables users to easily identify and manage documents that require attention.

Login Information Persistence Enhancement (SHE-58623)

SigningHub introduces the ability to remember user email and enterprise or individual account information in the browser cache after a successful login. This ensures previously accessed enterprises are retained and available even when switching between enterprises within the same session, improving continuity and user convenience.

---

Security Improvements

SSRF Vulnerability Mitigation in Document Conversion (SHE-59729)

SigningHub addresses a high-priority SSRF vulnerability in the document conversion process by restricting external resource fetching from untrusted sources. The fix ensures that external requests are no longer executed during HTML-based document processing, preventing unauthorised access to internal or external resources.

Authentication Token Security Enhancement (SHE-58608)

SigningHub improves authentication security by moving refresh tokens from client-side storage to secure server-managed cookies. Token renewal is handled via the Web Gateway without exposing refresh tokens to the frontend. Additionally, access token storage in cookies has been replaced with a session ID-based approach to enhance security.

Document Locking for Recipient Updates (SHE-59407)

Document lock validation has been implemented when updating recipients in pending workflows. If the document is already locked, an error is returned; otherwise, the document is locked before the update to prevent concurrent signing and recipient modification.

Security Question Field Validation (SHE-59640)

The Security Question field includes enhanced input validation and expression handling, preventing invalid or unsafe entries.

Vulnerability Fixes

The following impacted CVEs have been resolved as part of this release:

CVE ID(s)	Severity	Affected Component	Updated Version
GHSA-g93w-mfhg-p222	High	angular/compiler	20.3.19
GHSA-prjf-86w9-mfqv, GHSA-g93w-mfhg-p222	High	angular/core	20.3.19
GHSA-xxjr-mmjv-4gpg, GHSA-r5fr-rjxr-66jc, GHSA-f23m-r3pf-42rh	High	lodash	4.18.1
GHSA-qpx9-hpmf-5gmw	High	underscore	1.13.8
GHSA-v3m3-f69x-jf25	Low	quill	2.0.2

In addition, several other third-party dependencies have been updated to improve stability, security, and compatibility.

---

New ADSS Server Support

ADSS Server Support

SigningHub supports ADSS Server 8.4.0.

---

New AI Server Support

AI Server Support

SigningHub supports AI Server 1.3.x.

---

New Identity Verification Server Support

Identity Verification Server Support

SigningHub supports Identity Verification Server 2.0.

---

Important System Changes

As part of the upgrade to SigningHub 10.0.5:

• The AI Server selection previously configured in the Service Plan has been moved to the Default AI Connector in Global Settings. Administrators must configure the default AI connector in Global Settings to restore AI functionality.

• Syslog-based logging configuration requires the NLog.Targets.Network dependency across all relevant services. Deployments using syslog targets must include this package to ensure logging is initialised and functions correctly.

• The default value of the HSTS max-age header has been increased from 60 days to 365 days. Existing deployments using custom configurations may need to review and update this value in their appsettings.Production.json files as required.

• The SSL Authentication Open API returns a subject_token when a .pfx certificate is provided. Integrations must authenticate using the subject_token with the token_exchange grant type via the Authentication Gateway. The subject_token contains the certificate user’s email and SSL profile information. In cases where the SSL authentication profile is set to Password and the provided password does not match, the response header x_email has been renamed to x_email_address.

• The Kerberos Authentication API returns a subject token instead of an access token and a refresh token. The Authentication Gateway requires the subject token with the token exchange grant type to generate a Kerberos access token. The subject token contains Active Directory user information, including email address, profile name, preferred name, job title, and company name.

• When upgrading to SigningHub v10.0.5 in a Docker-based environment, a container restart is required to ensure the system becomes fully healthy and operates correctly. Use the following command to restart the containers: docker compose --profile first-time restart

---

Compatibility with Earlier Versions of SigningHub

SigningHub (iOS) & (Android) v10.0.5 are compatible with SigningHub 10.0.4 except for the breaking changes mentioned in the Important System Changes section.

---

For further details, contact us at [e-mail] or visit www.ascertia.com.