ZL154/JellyfinSecurity v2.5.6

v2.5.6 - Security + bug-fix release

on GitHub

v2.5.6 — Security + bug-fix release.

What's fixed

• Critical: bare DeviceId can no longer bypass 2FA. The "registered device" and "paired device" fallbacks accepted any client-supplied DeviceId with no signed token — a stolen password plus a known/guessed device id skipped 2FA entirely. v2.5.6 gates those paths behind a new BareDeviceIdBypassEnabled flag (default off). The signed trusted-device cookie path is unchanged and still works.
• Issue #28 — OIDC redirect_uri was built as http:// behind TLS-terminating reverse proxies (Cloudflare Tunnel, some Caddy / nginx setups) which the IdP refused. New providers default to ForceHttps=true; existing providers also get https automatically when the IdP's discovery URL is https://. No more manual toggle required.
• Issue #48 — OIDC sign-in failed when a Jellyfin user with the matching preferred_username already existed (e.g. created before the plugin was installed). v2.5.6 links the pre-existing user on first OIDC sign-in instead of trying to create a duplicate.
• Issue #49 — Login showed "incorrect username or password" instead of the 2FA challenge for some users. Fixed the race between inject.js and Jellyfin Web's bundled scripts + widened the auth-path matcher to handle relative URLs.
• Issue #50 — Email OTP UI said "6-digit" but the server generated 8-digit codes (v2.5.5 raised the digit count for brute-force resistance). Input + labels now match across all bundled languages.

What's new

• Hardened-security policy for self-service 2FA changes (SelfServiceStepUpMode, default Forced). Adding / replacing any factor — TOTP, recovery codes, app password, passkey — now requires the user to prove possession of an existing factor. Closes the stolen-session takeover path where an attacker with an authenticated cookie could silently enroll their own authenticator. The proof can be a TOTP / recovery code or a passkey assertion or an emailed OTP — the Setup modal lets the user pick.
• Email step-up — for users who don't have TOTP / passkey but do have email configured, the step-up prompt can mail them an 8-digit code.

Upgrade

• In-place. No schema changes, no required config edits.
• 254/254 tests pass on .NET 9 / Jellyfin 10.11.10.
• Existing OIDC providers that worked on v2.5.5 keep working unchanged.
• If your TVs / native clients relied on the old "registered device" bypass, you'll need to either flip BareDeviceIdBypassEnabled = true in plugin config OR sign in once + tick "Trust this device".

Thanks to hbjydev and fx-xt for the #28 reports, Gaarindor for #48, Belgarathian for #50, and everyone who's filed reproducible bug reports — they're what make these releases possible.