-
[Security] Fixed a security issue in the HybridAuth library used by Social Login. [Reported by Nathan Cross (CyberBadger)]
-
[Feature Pro] Passkeys: You can now log in to your website using passkeys, making authentication faster, easier, and more secure without the hassle of passwords.
-
[Improvement Pro] Microsoft Social Login now identifies users by their Microsoft account ID instead of their email. The first Microsoft login to an account, or a registration, is now confirmed with a code sent to the user's email.
-
[Improvement] Social Login error messages are now escaped before being shown on the login page.
-
[Improvement] The Backuply install option now requires the install plugins capability.
-
[Bug-Fix Pro] Resetting the 2FA app secret key is now only possible from the 2FA settings page, that has been fixed.
-
[Bug-Fix Pro] 2FA emergency codes were not always removed after use, that has been fixed.
-
[Bug-Fix Pro] Username enumeration protection was not blocking all variations of the REST users endpoint, that has been fixed.
-
[Bug-Fix Pro] Users were not able to save their account settings on the Ultimate Member account page, that has been fixed.
-
[Bug-Fix] Social Login now refuses a login when the provider returns an invalid email, instead of sanitizing it.
-
[Bug-Fix] Login notification email was causing a fatal error when Really Simple Security 2FA was used, that has been fixed.
-
[Bug-Fix] Security settings page input fields would show empty fields when saved, this has been fixed.
