v2.6.5

A feature release aimed at the clients two-factor authentication is hardest on — TVs and streaming boxes that can't show a challenge — plus out-of-band code delivery over Telegram, an OIDC avatar fix, and more admin notifications. Built from the open issue backlog. Drop-in from any 2.5.x or 2.6.x, with no config or data migration.

Signing in on a limited device

• One-time device codes (#270, by @p1zzm1ssile; #216, by @Heldenkrieger01). A Fire TV, a TV app that can't render the challenge page, or any client where Quick Connect isn't an option can now be signed in with a single-use code. You generate it from your phone on the Two-Factor Auth page; it is shown there and also sent to your email and your linked Telegram, so you can read it next to the device. It works once, expires in 30 minutes, and is then gone. The existing "approve on a second screen, trust the device" Quick Connect flow is unchanged and remains the smoothest path where Quick Connect is available.

One-time codes over Telegram

• Receive your sign-in codes on Telegram (#285, by @p1zzm1ssile). Email was a single point of failure for one-time codes — when a mail provider goes down, nobody can get a code. You can now link your own Telegram chat on the Two-Factor Auth page, confirmed by a code the bot sends you, and login and step-up codes are delivered there as well as by email. Each user's codes go only to their own chat, never a shared admin chat.

OIDC avatars

• Profile pictures that change at the same URL now refresh (#286, by @cydy; follow-up to #66). Identity providers such as Pocket ID serve an updated avatar at the same per-user URL, so the plugin never picked up the change, and a missing local avatar was never recovered. Sync now revalidates with an ETag (and a content hash where the provider sends none), and re-fetches whenever the local avatar has gone missing.

Notifications

• Admin alert on a failed sign-in (#272, by @p1zzm1ssile). A wrong two-factor code now notifies the admin's configured channels (email, Telegram, ntfy, webhook) with the running attempt count, so a brute-force run is visible as it climbs toward lockout.
• A welcome email when an MFA email is set (#271, by @p1zzm1ssile). Registering, or changing, an account's two-factor email sends a one-off setup email, which doubles as a check that the address is reachable — a typo surfaces then, not at a locked-out sign-in. On by default; needs SMTP.

App passwords

• Optionally refuse app passwords for more clients (#244, by @AmperageOverspend). The web interface is always refused — an app password typed there would sign in with no second factor and reach admin settings. An admin can now also list first-party apps that can show the challenge, so an app password is useful only for genuinely limited clients. The default is unchanged.

Fixes

• The second-screen-pairing toggle no longer overlaps the rows above it in the admin Settings tab.

Upgrade notes

In-place upgrade from any 2.5.x or 2.6.x, with no schema or configuration migration. Both the 10.11 (.NET 9) and 12 (.NET 10) packages are published and your server selects the right one automatically. Sigstore-signed and SLSA build-provenance attested. 787 tests across both builds; 911 translation keys in 8 languages.