v2.7.0

A large release built mostly from contributor pull requests by @camarigor, with community fixes from @cterence and @Samalbert977. It adds sign-in paths for the clients and proxies that can't show a two-factor challenge, usernameless passkeys, localized emails, and a batch of login, lockout, and passkey correctness fixes. Drop-in from any 2.5.x or 2.6.x, with no config or data migration. Every new sign-in feature is opt-in and off by default.

Sign-in for limited clients and proxies

• Send the login page straight to a provider (#297, by @camarigor; opt-in). For an SSO-only server, a web browser can open the configured provider's sign-in without a click, with loop guards and an ?oidcAuto=0 escape so a redirect that returns to the login page can never loop.
• Sign in through a trusted reverse proxy that names the user (#298, by @camarigor; opt-in, off by default). Header sign-in for setups where a proxy authenticates people itself (NetBird, Authelia, oauth2-proxy). It is gated on a trusted-proxy CIDR checked against the raw TCP peer, a same-origin Sec-Fetch-Site, a single clean header value, a rate limit, and an admin refusal unless explicitly allowed — the username header is believed only after all of those pass.
• Accept the authenticator code typed after the password (#312, by @camarigor; opt-in). An app that can't show the challenge signs in with the password immediately followed by the current 6-digit code, no space (MyPassword123456); the plugin checks the password, then the code, and only the password goes on to Jellyfin.
• Send a sign-in code to apps that can't show the challenge (#313, by @camarigor; opt-in). The challenge also emails, and Telegrams, an 8-digit code, re-entered with the password — or alone, same address only. Complements the one-time device codes from v2.6.5 (#270).

Passkeys

• Sign in with a passkey without typing a username (#319, by @camarigor). With the username field empty, the browser offers the passkeys it holds for the site and the server names the account of the one picked.
• Keep the bridge token out of the password field (#332, by @camarigor). Stops password managers prompting to "update saved login" after a passkey sign-in.
• Choose whether a passkey adds a second factor after a password sign-in (#339, by @camarigor; on by default). A passkey registered only for passwordless sign-in no longer forces a 2FA challenge after a password; admin enforcement and a verified authenticator app still take precedence.
• A passkey challenge now behaves like a code (#327, by @camarigor). Completing it clears failure state and honours Trust-this-device, and a newly added passkey is offered in the step-up prompt without a reload.

Correctness and hardening

• Step-up is now required to change where codes are delivered (#305, by @camarigor). The Email and Telegram link/unlink endpoints are gated like other factor changes, closing a gap where a hijacked session could redirect a user's one-time codes.
• A 2FA challenge no longer counts as a failed sign-in, and an expired lockout clears itself (#329, by @camarigor).
• A completed password change clears the plugin's temporary lockout (by @camarigor), leaving 2FA, IP bans, the token blocklist, and Jellyfin's own lockout untouched.
• Quick Connect tokens the plugin already approved are no longer blocked (#304, by @camarigor).
• Requesting a step-up proof no longer counts as a failed attempt (by @camarigor).
• The standard-login-page redirect loop is fixed (#295, by @Samalbert977). A browser holding a blocked token can reach Jellyfin's own login page, with the SSO button, again.
• PW is accepted as the sign-in password field (#316, by @cterence). go-jellyfin clients such as Supersonic can sign in with an app password again.
• OIDC auto-created users never inherit a disabled state (#243). The template-user policy copy no longer carries IsDisabled, so a user the identity provider just authenticated can't be born disabled, and removing the plugin can't leave one stranded.

Settings page and proxies

• The settings page loads behind Jellyfin's nginx example (#309, by @camarigor). It no longer needs a synchronous request, so a sync-xhr=() permissions policy no longer leaves it blank; the README documents the header tweaks.
• A reverse proxy or WAF that replaces the plugin's answer is named in the error (#320, by @camarigor), with a narrow ModSecurity exclusion documented for the passkey endpoints.

Internationalization

• Reset and sign-in-code emails, and the reset page, are shown in the recipient's language (#318, by @camarigor).

Dependencies

• Fido2 4.3.1, QRCoder 1.8.1, MailKit 4.18.2, System.Security.Cryptography.Pkcs 10.0.14, plus analyzer and CI action bumps (#301 and the folded Dependabot batch). The Jellyfin runtime references stay pinned.

Upgrade notes

In-place from any 2.5.x or 2.6.x, no schema or config migration. Both the 10.11 (.NET 9) and 12 (.NET 10) packages are published; the server selects the right one. Sigstore-signed and SLSA build-provenance attested.