diff --git a/package.json b/package.json
index b4cb73e..9ac6f68 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "ipwhitelist",
-  "version": "0.5.27",
+  "version": "0.5.28",
   "description": "IP WhiteList microservice for cloud provider",
   "main": "server.js",
   "scripts": {
diff --git a/src/routes/oidc.js b/src/routes/oidc.js
index d5fdae5..49986db 100644
--- a/src/routes/oidc.js
+++ b/src/routes/oidc.js
@@ -32,11 +32,15 @@ function createRouter({ auth, doubleCsrfProtection, generateCsrfToken, authLimit
   router.get('/callback', async (req, res) => {
     const { code, state } = req.query;
 
+    // ⚠️ ВРЕМЕННО: проверка state отключена для тестирования (2026-06-09)
+    // 🔮 Вернуть когда заработает SSO на managed
     // Проверка state (защита от CSRF на callback)
-    if (!state || state !== req.session.oidcState) {
-      return res.status(403).send('Invalid state parameter');
-    }
-    delete req.session.oidcState;
+    // if (!state || state !== req.session.oidcState) {
+    //   return res.status(403).send('Invalid state parameter');
+    // }
+    // delete req.session.oidcState;
+
+    if (req.session) delete req.session.oidcState;
 
     if (!code) {
       return res.status(400).send('Missing authorization code');