github aussierk/jellyfin-plugin-oidc v1.0.3.0
v1.0.3 - Remove unsafe display name sync

latest releases: v2.1.0.1, v2.1.0.1-rc.25, v2.1.0.0...
4 months ago

Change

The display name sync feature introduced in v1.0.2.3/v1.0.2.4 had a fundamental flaw: looking up a Jellyfin user by their OIDC display name can accidentally match an unrelated local account whose Jellyfin username happens to equal the display name. This caused wrong-account logins and broke new user registration.

The feature is disabled in the UI with an explanation. The setting is preserved in config for when upstream Jellyfin support lands.

What's needed for proper implementation

Jellyfin needs to expose a stable external subject ID field (the OIDC sub claim) on the User entity so accounts can be looked up by identity rather than by a mutable name. This requires an upstream Jellyfin PR.

Full Changelog: v1.0.2.4...v1.0.3.0

Don't miss a new jellyfin-plugin-oidc release

NewReleases is sending notifications on new releases.