On the authentication front, Kyber now supports OpenID Connect (OIDC), giving teams and self-hosters the ability to integrate with existing identity providers such as Keycloak, Auth0, or any standards-compliant SSO system. Both the server and the desktop client support the full OIDC flow. The RTP streaming backend, which had silently stopped working after IPv6 support was added in 0.25.0, is now fixed.

The media pipeline receives a major upgrade with FFmpeg 8.1, bringing improved codec support and performance. AMD (AMF) and Linux VAAPI encoder settings are now correctly applied, resolving encoding quality and configuration issues. On Windows, Intel's HEVC 4:2:2 and 4:4:4 encoder has been replaced with the Microsoft equivalent, which is more broadly supported. Two new Linux screen capture backends — XCB and wlroots — are now available, expanding compatibility with different desktop environments.

The server's Windows system tray is now more resilient: tray icon initialization failures no longer crash the server, and the tray recovers automatically if the Windows taskbar is restarted. The service also stops its restart loop when it detects an invalid configuration rather than cycling indefinitely. The connected-client count shown in the tray is now correctly updated when sessions time out. The server watchdog process, previously always active, is now optional and can be disabled if not needed. On the web client side, the UI ships updated branding.

Changelog​

• kynput/x11: Add clipboard support
• libkynput/win32: Add HTML clipboard support
• controller/ws: Use kycom to interact with kyavserver and kynput
• kycontroller/win32: Make tray init non-fatal with TaskbarCreated recovery
• kyservice/win32: Stop restart loop on invalid config
• kycontroller: Update tray client count on session timeout
• kycontroller: make watchdog optional
• kymedia: Bump to ffmpeg 8.1
• kymedia: Correctly configure amf and vaapi encode settings
• kymedia/vlc: Replace Intel HEVC 422/444 support by the Microsoft one
• kymedia: Add "xcb" and "wlroots" grab_backend
• kycontroller: Add OIDC support
• desktop: Add OIDC support
• kycontroller: Fix RTP backend. Was broken since IPv6 support
• kynput: Export scancode conversion helpers for all platforms
• (web) ui: integrate new branding
• (web) kyctl: Extract AV players into separate crates

Linux gains a DRM/KMS screen capture backend in this release, complementing the existing X11 and NvFBC options and enabling capture directly at the display driver level — useful for setups without a traditional desktop environment. The Windows server now displays a system tray icon, giving quick visual feedback on the server's state. On Windows, display unplug events during an active streaming session are now handled correctly by the capture and encoding server, preventing crashes or hangs when a monitor is disconnected at runtime.

The command-line tool now surfaces control-plane connection errors clearly instead of silently failing, making troubleshooting easier. A bug where the server's configured public port was incorrectly cached and served stale values to clients has been fixed, as has a deadlock that could cause the login endpoint to block indefinitely under load. The web client adds HTTP timeouts to all outgoing requests, preventing hangs in degraded network conditions. JWT key generation is now available directly from the command-line tool, streamlining certificate and token management. The server's incoming connection handling is also more robust against edge cases in the QUIC transport accept loop. On Windows, keyboard setting changes are now monitored at runtime so input behaviour stays correct if the user adjusts keyboard settings while a session is active.

Changelog​

• kycontroller: Redirect /webclient to /webclient/
• kynput/win32: Monitor keyboard setting changes
• kyclient: Use rustls-platform-verifier
• kycontroller/win32: Add tray icon
• linux: Implement DRM/KMS grab
• kyavservice/dxgi: Correctly handle display unplug at runtime
• kyctl: Expose control plan connection error
• kyclient: Add HTTP timeout to all requests
• kycontroller: Fix public_port incorrectly cached in shared Kymux infrastructure
• kyctl/jwt-gen: Add key generation support
• kycontroller: Improve robustness of kymux incoming connection accept
• kycontroller: Fix /login blocking forever on mutex contention
• Add IPv6 support
• (web) Add IPv6 support
• (web) kyclient: Add HTTP timeout to all requests

Cross-origin protections in the server have been tightened, reducing the attack surface for browser-based deployments. The Intel Quick Sync (QSV) encoder initialization bug that prevented QSV encoding from starting in some configurations is fixed. Log verbosity can now be controlled with the KYBER_VERBOSE environment variable without editing configuration files, which helps with debugging in production environments. The QUIC transport layer has been updated to wtransport 0.7.0, replacing the previously pinned pre-release build. The clipboard is now size-limited on the input handling side, preventing unexpectedly large clipboard payloads from being forwarded across the connection.

On the web client, the sidebar is now scrollable, fixing layouts where many options were cut off. A button to send Ctrl+Alt+Del directly to the host has been added to the sidebar — useful for Windows remote desktop scenarios. The web client also gains the same basic password authentication support as the desktop client.

Changelog​

• Rename kysdk components
• Correctly place shebang in build scripts
• kyclient: Update VLC. Kymux branch is now based on 4962271021
• kycontroller: Correctly log toml parsing errors
• kymux: Update wtransport to official 0.7.0
• kynput: Limit clipboard size
• kycontroller: Improve cross origin protections
• Add basic authentication password support
• Allow to disable jwt backend
• kyavserver: Fix QSV acquisition
• kyavserver: set log level based on KYBER_VERBOSE environment variable
• (web) sidebar is now scrollable
• (web) sidebar: Add a button to send Ctrl+Alt+Del to the host
• (web) Add basic authentication password support

Changelog​

• avserver/ffmpeg: Remove ffmpeg --non-free flag
• desktop: Add more TLS certificate verification options
• (web) Integrate new repository tree

Automatic reconnection is now built into both the desktop and web clients. When a connection drops unexpectedly, the client will attempt to reconnect transparently without requiring manual intervention. The web client exposes this through new reconnecting, reconnected, and reconnection_failed events, allowing web-based integrations to react accordingly. Multi-client support arrives on the server side: multiple clients can now connect to the same streaming session simultaneously, laying the groundwork for collaborative and monitoring use cases.

Two new capture backends have been added for Linux. NvFBC support enables high-performance, low-latency capture directly from NVIDIA GPUs, bypassing the compositor entirely. A watermark feature is available on Windows and Linux X11 with NVENC, allowing a visible overlay to be stamped on the captured stream — useful for content attribution or identifying source machines in multi-host setups.

On Windows, the capture and encoding server now prevents the display from sleeping when a frame acquisition timeout occurs, keeping the host awake during active sessions. Display hotplug events are now detected and handled at runtime, so connecting or disconnecting a monitor no longer requires a server restart. The x264 software encoder is now available on Windows as a fallback when hardware encoding is not available or desired. QUIC and WebTransport connections can now be handled simultaneously on the same server, improving compatibility with different client types. TLS certificate hashes are now verified by the client for QUIC connections, and TLS certificate paths have also been made configurable in the server configuration file. On Windows, multiple server instances can now run on the same machine without conflicting, and child processes are automatically cleaned up if the parent exits unexpectedly. The keyboard is grabbed in fullscreen mode on both Windows and Linux, ensuring key events are not intercepted by the local OS. The web client fixes scroll behaviour in Safari, resolves a configuration UI loading issue in Safari, and adds a gamepad blocklist option for filtering unwanted input devices.

Changelog​

• windows/linux: Grab keyboard when fullscreen is enabled
• desktop: Add automatic reconnection support
• libkypc/windows: Implement automatic child process cleanup
• windows: Allow to run multiple controller instances on the same machine
• vlc: Fix build issues for Windows cross build and iOS/visionOS build
• controller: make TLS certificate paths configurable
• avserver/win32: Prevent display sleep on frame acquisition timeout
• controller: QUIC and Webtransport connections can now be handled simultaneously
• libclient: Verify TLS certificate hash for QUIC connections
• Implement watermark feature. For Windows and Linux X11 + nvenc only
• linux: Implement NvFBC grab
• controller: Add basic multi-client support
• avserver/win32: Allow to use x264
• avserver/win32: Detect display hotplug
• (web) libkynput: Fix scroll behaviour in Safari
• (web) jsapi: Add gamepad blocklist support
• (web) ui: Vertically center canvas
• (web) Add automatic reconnection support with new events: reconnecting, reconnected, reconnection_failed
• (web) html: fix config ui loading in safari

⚠️ This patch regenerates the bundled TLS test certificates, which had expired. Both the desktop and web clients are affected. Update both the server and client to restore TLS connectivity if you use Kyber's built-in test certificates.

Changelog​

• tls: Regenerate test certificate
• (web) tls: Regenerate test certificate

Changelog​

• controller/auth: Correctly generate cookie key generation

On Windows, key repeat is now handled on the host side, ensuring that held keys produce repeated input events correctly regardless of the client's local keyboard repeat settings. Unicode codepoint injection is also now supported on Windows, making it possible to send arbitrary Unicode characters to the host — important for input method editors, non-Latin scripts, and special characters. The virtual display service on Windows now supports more than one virtual screen, enabling multi-monitor remote desktop configurations with multiple virtual monitors.

The capture and encoding server has been updated to FFmpeg 7.1.2. At startup, the server now logs all available GPU adapters and identifies which one it selected for encoding, making it easier to diagnose GPU selection issues in multi-GPU machines. The clock offset between client and server is now always synchronised, not just at connection start, improving timestamp accuracy over long sessions. Server process startup errors are now logged with more detail, making failure diagnosis faster when the server fails to start a subprocess.

Changelog​

• Add authentication support
• libclient: always update clock offset
• libkynput/win32: Implement keypress repetition on Host side
• libkynput/win32: Add Unicode codepoint injection support
• windows_service/kidd: Allow to plug more than one screen
• avserver: Update to ffmpeg 7.1.2
• avserver/win32: Log available adapters and used adapter
• controller: Correctly log when a process fails to start
• (web) Add authentication support
• (web) libclient: always update clock offset

The audio capture pipeline on Windows fixes a channel count mismatch that could cause audio to be incorrectly routed or silenced in certain multi-channel configurations. PS4 controller trigger injection is fixed — triggers were previously not registering correctly when injected on the host side. The input handling layer is updated to SDL 2.32.8, picking up upstream bug fixes and compatibility improvements.

Metrics support is integrated into both the desktop and web clients, providing a foundation for monitoring streaming health and performance. The networking stack has been updated to current versions, incorporating security patches and performance improvements. The web JavaScript API now exposes the current bitrate in client state, and the bitrate is also reported immediately at connection start.

Changelog​

• Rust toolchain updated to 1.89.0
• windows: Add clipboard support for client and host side
• libkynput: Correctly inject PS4 controller triggers. PS4 triggers must also be injected as buttons
• Integrate metrics support
• Update actix, rustls, quinn, wtransport
• avserver/wasapi: Correctly fill channel count
• libkynput: Update SDL to 2.32.8
• (web) Rust toolchain updated to 1.89.0
• (web) libkynput: Add Clipboard support
• (web) jsapi: Expose bitrate in ClientState
• (web) libclient: Notify bitrate at startup
• (web) Integrate metrics support
• (web) Upgrade web-sys/js-sys to 0.3.77
• (web) Upgrade wasm-bindgen-cli to 0.2.100

Changelog​

• libkynput: Don't fail on first malformed packet

Session tracing improves significantly: the server now generates a unique Session ID at the start of each stream, logs it, and sends it to the client. The client logs this ID upon receiving it, making it straightforward to correlate server and client logs for a specific session when diagnosing issues. The QUIC transport layer now filters out duplicate frames in the GopStream protocol, preventing redundant data from reaching the decoder.

On Windows, the capture and encoding server implements a monotonic clock, avoiding timestamp issues caused by non-monotonic system clock sources. The clock source used by the stream processing pipeline is now configurable from kyber_config.toml. The NVENC encoder now correctly sets the GOP size when intra-refresh is disabled. The QUIC transport automatically finds an available IPC port at startup instead of requiring manual configuration. The input handling C API gains rumble unpack support and includes vendor and product IDs in gamepad plug packets, enabling more precise gamepad identification. The web client fixes cases where mouse position events were incorrectly sent instead of relative mouse move events, and adds Client.disconnect_and_stop() for cleaner teardown from JavaScript. Gamepad plug and unplug notifications are now exposed through the JavaScript API, and audio initialization is skipped gracefully when SharedArrayBuffer is unavailable in the browser context.

Changelog​

• avserver/win32: Implement monotonic clock
• windows_service: Correctly log CreateProcessAsUserW() error
• kymux: Try to find an available port when starting IPC
• kyaudioreg: Fix compensation
• desktop: Add --audio-buffer parameter
• controller: Remove timeout on avserver kill
• libclient/rtp: Allow to override the SDP folder with envvar KYBER_CACHEDIR
• libkynput: Add SDL2 feature to be able to trigger SDL2 support
• libkynput/capi: Add rumble unpack
• libkynput/capi: Add vendor/product id in libkynput_gamepad_plug_to_packet()
• txproto: Rebase to upstream/master
• desktop: Bitrate can now changed dynamically during runtime
• avservice: Allow to configure txproto clock source from kyber_config.toml
• kyaudioreg: Rework underflow log
• desktop: Add video-buffer option
• avservice: By default, the video bitrate can't be set under 5 mbps
• avservice: Allow to configure the minimum allowed video bitrate
• avservice/nvenc: Set GOP when intrarefresh is disabled
• controller: Generate, log and send a SessionId on streaming start
• libclient: Log SessionId sent by controller on streaming start
• kymux: Filter out duplicates in GopStream
• (web) jsapi: Add audio_buffer parameter
• (web) kyproto/kyaudioreg/libclient: Use kywasmtime
• (web) jsapi: Add live bitrate control
• (web) libclient: Skip audio initialization if SharedArrayBuffer isn't defined
• (web) kyaudioreg: Rework underflow log
• (web) jsapi: Add video_buffer option
• (web) kymux: Filter out duplicates in GopStream
• (web) libclient: Log SessionId sent by controller on streaming start
• (web) jsapi: Expose gamepad plug/unplug notifications
• (web) inputs: Fix cases where MousePosition where sent instead of MouseMove
• (web) jsapi: Add Client.disconnect_and_stop() to both disconnect and stop the Client

Changelog​

• controller: Log initialization errors in controller.log

Changelog​

• avserver: Log when display enumeration has been started
• avserver: Add pid in logs
• txproto/dxgi: Add more error logs
• txproto/wasapi: Reduce some log severity
• controller: Log actix server errors
• controller: Log displays at startup
• libclient: Stop backend on DataPlaneClosed
• (web) libkynput: Notify JsElementNotFound once in mousemove if canvas has been dropped
• (web) libkynput: Unregister window events if canvas has been removed
• (web) libclient: Stop backend on DataPlaneClosed

The desktop client now correctly hides the cursor at startup when the session requires it, and keyboard shortcuts for adjusting audio volume have been added. A workaround has been applied for a Windows-specific issue where negative presentation timestamps could occur while the NTP clock was adjusting backwards, which previously caused encoding problems.

On the web side, a bug that prevented the correct screen resolution from being applied on display selection has been fixed. A spurious warning that appeared in logs on deliberate disconnect has been suppressed, and missing WebTransport certificate hashes from the server are now handled gracefully. Volume and mute controls are available through the JavaScript API.

Changelog​

• desktop: Refactor protocol selection and add audio protocol parameter
• desktop: Correctly hide cursor at startup if required
• avserver/win32: Workaround negative PTS generation while NTP goes backward in time
• controller/ws: Handle close control frame
• libclient: Update VLC. Kymux branch is now based on 6880921445
• libclient: Allow to rely on builtin OS TLS certificates
• desktop/kymux-audio: Add unreliable parameter
• controller: Correctly load the complete certificate chain
• controller/ws: Make server certificate generation optional
• desktop: Add audio volume keyboard shortcuts
• Update Quic stack (quinn 0.11.5, wtransport 0.4.0, rustls 0.23.13)
• (web) jsapi: Refactor protocol selection and add audio protocol parameter
• (web) inputs: Fix display selection. The screen resolution wasn't correctly selected
• (web) Also log video coded size when receiving libclient::Event::CanvasResized
• (web) libclient: Avoid to display "Failed to receive audio/video from Kymux" when disconnection has been requested
• (web) libclient: Handle cases where controller gives no Webtransport hash certificate
• (web) jsapi: Add audio volume/mute API

Changelog​

• desktop: Add --gamepad_force_xbox360
• libclient: Log intra_refresh setting received in StreamingSessionConfig
• (web 0.5.2) jsapi/start_streaming: Correctly return an error when displaylist is unknown
• (web 0.5.1) Correctly handle display resolution change (0.5.0 regression)
• (web 0.5.1) libclient: Log intra_refresh setting received in StreamingSessionConfig
• (web 0.5.1) jsapi: Add gamepad_force_xbox360 parameter

Two bugs in the QUIC transport layer for unreliable datagrams have been fixed — duplicate datagram handling and the sequencer — improving reliability of the low-latency transport path. On Windows, PlayStation controllers are now registered as PS4 controllers, ensuring correct button mapping in games that distinguish between controller types. The console window on Windows is hidden so Kyber runs more cleanly in the background. Audio regulator integration is now complete on both desktop and web, providing stable, drift-free audio playback. The web client also gains the ability to send gamepad Product and Vendor IDs to the host.

Changelog​

• libclient: Integrate kyaudioreg
• avserver: Allow to overload encoder configuration from kyber_config.toml
• kymux: Fix duplicate datagram handling with unreliable
• kymux: Fix sequencer for unreliable protocols
• desktop/win32: Hide console
• desktop: Add multiscreen support. Can be enabled with option --display_count
• desktop: Allow to configure Intra refresh with option --intra_refresh
• inputserver/win32: Plug PlayStation controllers as PS4 controllers
• controller: Allow to override dataplane port
• (web) libclient: Integrate kyaudioreg
• (web) Add intra_refresh parameter. This allows to override encoder configuration
• (web) libkynput: Send gamepad's Product Id and Vendor Id
• (web) libkynput: Avoid to spam when rumble isn't supported

Changelog​

• kymux: Fix unreliable header size
• desktop: Expose kymux_unreliable protocol
• macos: Fix window size sometimes being invalid when resizing on macOS 14 Sonoma
• avserver/win32: Make process DPI aware
• inputserver/win32: Make process DPI aware
• desktop: Move the host cursor position to match the local one at startup
• libclient: Improve start and stop logs
• (web 0.4.2) libclient: Make AudioRegulator lock free
• (web 0.4.1) kymux: Fix unreliable header size
• (web 0.4.1) Expose kymux_unreliable protocol
• (web 0.4.1) libclient: Improve start and stop logs

The most user-visible change in this release is that audio is now enabled by default — you no longer need to pass an extra flag to hear sound from the remote machine. Audio playback now uses the audio regulator on Windows, Linux, and macOS, producing smoother, more consistent output. The web client benefits from the same audio regulator and gains support for YUV 4:4:4 HEVC decoding in Chrome 126 and later.

Changelog​

• avserver: Support yuv444p for hevc when using qsv
• avserver/win32: Update nv-codec-headers to n12.1.14.0
• avserver/win32: Update vpl to v2.10.1
• avserver/win32: Update amf to 1.4.33
• avserver: Update ffmpeg to 6.1.1
• libclient: Update VLC. Kymux branch is now based on dfd6d83e50
• vlc: Use AudioRegulator on Windows/Linux/macOS
• desktop: Audio is now enabled by default
• Update Rust dependencies
• kymux: Revert timeout detection
• libclient: Stop websocket on ControlPlaneClosed
• libclient: Log PlayerConfig on start_streaming()
• avserver: Improve initialization logs in dxgi and packet_sink
• avserver/amf: Add missing D3D11 flags to support AMD Ryzen 7 PRO 5875U
• (web) libclient: Use AudioRegulator
• (web) Update Rust dependencies
• (web) kymux: Revert timeout detection
• (web) libkynput/wasm: Log gamepad id
• (web) libclient: Send a notification to the main worker when VideoDecoder is configured
• (web) libclient: Support yuv444p for hevc. Requires Chrome 126

Connection robustness has also improved: the data plane now has a one-minute timeout so stalled connections are detected, the client stops cleanly if the data plane fails or the streaming session cannot start, and a race condition that was causing spurious 403 errors when starting a stream has been fixed. Support for the Side and Extra mouse buttons has been added to input handling, and macOS builds now use FFmpeg 5.1.1. A new /stop_streaming endpoint lets you stop a streaming session without tearing down the entire server process.

The web client picks up all of these improvements and adds the ability to stop and restart both the client and the streaming session independently without reloading the page. Gamepad detection now works even without a gamepadconnected browser event firing, a decoder crash that affected Mac users has been fixed by increasing the video decoder queue size, and log noise on data plane disconnect has been reduced.

Changelog​

• Rust toolchain updated to 1.76.0
• controller: Update wtransport to 0.11.0
• controller/cors: Allow Access-Control-Allow-Credentials
• controller: Add /stop_streaming endpoint
• controller: Fix racy kymux stop. Should fix the remaining 403 errors when starting kymux
• avserver: Integrate libtxproto
• avserver: Encoder selection now applies also to RTP backend
• avserver: Detect Initialization/Acquisition/Encoding errors and forward them to the application
• controller: Forward avserver crash to the application
• kymux/kycom: Fix TcpStream read error
• controller/libclient: Implement connection timeout detection (1 minute) on Data Plane. The event is only logged for now
• libclient: Stop if Data Plane connection fails, or if streaming start fails
• libclient/macos: Use ffmpeg 5.1.1 (like Windows) instead of master
• avserver: Support yuv444p for hevc when using nvenc
• libkynput: Handle Side/Extra MouseButtonType
• txproto: Avoid to drop encoded frames when network is slow. Drop acquired frames instead
• kymux: Correctly handle write during congestion, when using wtransport backend
• (web) Client can now be stopped and restarted
• (web) Streaming can now be stopped and restarted
• (web) libclient/http: Set credentials=include when calling fetch()
• (web) avserver: Detect Initialization/Acquisition/Encoding errors and forward them to the application
• (web) controller: Detect avserver crashes and forward them to the application
• (web) Implement connection timeout detection (1 minute) on Data Plane. The event is only logged for now
• (web) libclient: Stop if Data Plane connection fails, or if streaming start fails
• (web) libkynput: Plug gamepad when detected without gamepadconnected
• (web) libclient: Increase Demuxer -> Decoder video queue size to fix decoder crash on Macs
• (web) libkynput: Handle Side/Extra MouseButtonType
• (web) libkynput: Avoid to spam when DataPlane is disconnected

On Windows, a long-standing latency issue with H.264 hardware decoding in Chromium-based browsers has been resolved through a fix to how encoder parameters are packaged for the stream, resulting in noticeably snappier video for affected users.

The web client receives all of the same connection-lifecycle improvements alongside several stability fixes. The host cursor shape is now applied correctly only when the pointer is actually inside the video canvas. A new API lets you query which video codecs the browser supports, and notifications — including canvas resize events — are now delivered through a unified notification system. The client will now automatically stop itself on a video decoding error rather than hanging, and audio decoding errors are handled gracefully as well. Gamepad handling no longer panics on unrecognised buttons or axes, and two startup crashes have been fixed.

⚠️ The web client JavaScript API and the server protocol both contain breaking changes in this release. Existing web integrations will need to be updated.

Changelog​

• controller/libclient: Implement connection timeout detection (1 minute) on Control Plane
• Add client lifecycle notifications (connection failed, disconnected + reason)
• Connection steps are now splitted (1. Connect to the Control plane, 2. Start streaming session)
• avserver/win32: Correctly patch NVENC H264 SPS to fix H264 latency issue on Windows Chromium when using hardware decoding
• (web) ⚠️ This version introduces breaking changes ⚠️
• (web) The JS has breaking changes
• (web) The protocol with the controller has breaking changes
• (web) Implement connection timeout detection (1 minute) on Control Plane
• (web) cursor: Apply Host cursor shape only when the cursor is inside the canvas
• (web) Add supported_video_codecs()
• (web) Add a generic notification API. "canvas_resized" is now passed through this API
• (web) Add client lifecycle notifications (connection failed, disconnected + reason)
• (web) Improve callstack decoding in browser console
• (web) Client is now automatically stopped if a video decoding error is detected
• (web) Handle audio decoding errors correctly
• (web) gamepad: Avoid to panic when receiving unknown button/axis
• (web) Connection steps are now splitted (1. Connect to the Control plane, 2. Start streaming session)
• (web) Fix a case where cursor was hidden and not send after connection
• (web) Log client revision at startup
• (web) Fix a crash when VideoFrame queue is full at startup