Verbb

Changelog

2.0.30 2026-11-05

Fixed

  • Fixed an error when logging in with Reddit.
  • Fixed account connection reviews being impossible to resolve when the only connected user had been deleted.
  • Fixed returning users with an inactive account seeing a generic error instead of being told their account must be activated.

2.0.29 2026-11-01

Changed

  • Force Activation now activates new users when the provider does not report whether their email is verified. Disable the setting if these users should complete Craft's activation flow, especially if new accounts receive control panel access. (#63 (opens new window))
  • Bump verbb/auth to 2.0.57 to respect configured Azure prompt options.

Fixed

  • Fixed deleted users being unable to register again through the same provider account. (#64 (opens new window))
  • Fixed the Field Mapping tab listing Full Name twice, which discarded the mapping chosen in the first row.

2.0.28 2026-10-22

Changed

  • Updated the frontend build toolchain to Vite 8.3.4.

2.0.27 2026-10-17

Fixed

  • Fixed authentication provider class references that could fail on case-sensitive filesystems.

2.0.26 2026-10-15

Changed

  • Hardened email-based account matching.
  • Updated Craft API usage to avoid deprecated calls.

Fixed

  • Fixed a medium-severity authentication vulnerability.

2.0.25 2026-10-08

Added

  • Add provider connection controls to your own Craft account screen. (#52 (opens new window))
  • Add opt-in Microsoft Entra tenant email matching for managed members in explicitly allowed, tenant-verified domains.
  • Add a control-panel notice and account ownership review for provider accounts connected to multiple Craft users. (#60 (opens new window))

Fixed

  • Fix inactive duplicate users being created when an existing account cannot be matched to a provider email. (#52 (opens new window))
  • Fix provider callback feedback not appearing when returning to the control panel. (#52 (opens new window))
  • Fix legacy provider connection conflicts blocking plugin updates. Migrations preserve ambiguous connections for administrator review, including on previously upgraded sites, while unaffected accounts continue to sign in. (#60 (opens new window))

2.0.24 2026-10-07

Changed

2.0.23 2026-10-05

Fixed

  • Fixed a medium-severity resource exhaustion vulnerability.
  • Fixed a low-severity information exposure vulnerability.
  • Fixed a low-severity sensitive data exposure vulnerability.

2.0.22 2026-10-02

Changed

  • Updated the required version of verbb/base to 3.0.19.
  • Shopify is now connection-only and can no longer be used for login or registration. Sites relying on Shopify login must provide another login method.

Fixed

  • Fixed a medium-severity authentication vulnerability.
  • Fixed a low-severity path traversal vulnerability.
  • Fixed a low-severity request integrity vulnerability.
  • Fixed a low-severity server-side request forgery vulnerability.
  • Fixed a low-severity sensitive information exposure vulnerability.

2.0.21 2026-09-30

Changed

  • Identify returning users by their provider connection, and limit first-time account matching to a verified email or provider ID.
  • Enforce one Craft user per provider account. Existing cross-user connection conflicts must be resolved before the plugin migration can finish.
  • Require a specific Azure or Microsoft Entra tenant, or an expected Salesforce organization, for automatic administrator registration.
  • Restrict provider configuration to administrators, and require allowAdminChanges for updates.
  • Route plugin settings through the plugin’s authorized settings controller.

Fixed

  • Fixed a high-severity account-linking vulnerability.
  • Fixed a high-severity authorization vulnerability.
  • Fixed the provider identity migration failing when the plugin connection table does not exist.
  • Fixed OAuth callback transaction validation.
  • Fixed OAuth login and disconnect accepting unsigned external return URLs.

2.0.20 2026-09-14

Changed

  • Align documentation filenames with page titles and update internal links.
  • Updated documentation for clearer, more consistent guidance.
  • Clarified optional PHP configuration with focused examples and linkable setting details.

Fixed

  • Fix the providers admin table after settings normalization.

2.0.19 2026-09-13

Changed

  • Normalize plugin settings.

2.0.18 2026-09-04

Fixed

  • Fix SSO buttons being clipped in Craft’s session-expired login modal by resizing the Garnish modal after inject. #58.

2.0.17 2026-08-29

Added

  • Add enableCpElevatedLogin config setting to opt back into SSO buttons in Craft’s elevated-session “Confirm your identity” modal. #58.

Fixed

  • Fix SSO buttons still appearing in Craft’s elevated-session “Confirm your identity” modal (including after validation errors and during MFA). #58.

2.0.16 2026-08-20

Fixed

  • Fix control panel social login not respecting the “Stay signed in” checkbox.
  • Fix SSO buttons appearing in Craft’s elevated-session “Confirm your identity” modal. #58.

2.0.15 2026-07-15

Changed

  • Bump verbb/auth.

Fixed

  • Fix front-end login failing on detached CP installs.

2.0.14 2026-05-03

Changed

  • Bump verbb/auth to allow firebase/php-jwt 7.x.

2.0.13 2026-03-28

Added

  • Add the ability for some providers to allow admin registration.
  • Add the ability to override the default Redirect URI as a plugin setting.

Fixed

  • Fix an error when trying to resume a session for a user.

2.0.12 2025-11-29

Changed

  • Bump verbb/auth.

Fixed

  • Fix inactive users being able to login.

2.0.11 2025-11-06

Changed

  • Bump verbb/auth.

2.0.10 2025-07-18

Changed

  • Update English translations.

2.0.9 2025-05-01

Fixed

  • Fix an error when logging errors for unsupported email providers.
  • Fix status indicator for various UI elements.
  • Fix compatibility with Craft 5.2+ and the session-expired login modal.

2.0.8 2025-04-12

Fixed

  • Fix compatibility with Craft 5.2+ and the session-expired login modal.
  • Fix an error for some providers (GitHub, GitLab, PayPal).

2.0.7 2024-09-14

Added

  • Add Microsoft Entra provider.

2.0.6 2024-09-07

Added

  • Add the ability to set the endpoint version for Azure provider.

2.0.5 2024-08-11

Changed

  • CP Login templates now are wrapped with a .social-login-cp-container div.
  • Update syncProfile to be disabled by default.
  • Update English translations.

Fixed

  • Fix custom CP login template not resolving correctly.
  • Fix HubSpot default scopes.

2.0.4 2024-07-17

Fixed

  • Fix an error with Amazon Cognito provider.

2.0.3 2024-07-15

Added

  • Add sendActivationEmail plugin setting.
  • Add the ability to set data for a login request, where users might want to store extra information.
  • Add Amazon Cognito provider.

Changed

  • Revert callback URI change for cpTrigger = null (for detached CPs).

Fixed

  • Fix race conditions with plugin initialization. (thanks @nfourtythree).
  • Fix activation email logic.

2.0.2 2024-05-29

Added

  • Added a new Plugin setting for syncing user profiles for existing accounts (thanks @SwiseWeb).
  • Add the ability to set data for a login request, where users might want to store extra information.

Changed

  • Update English translations.

Fixed

  • Fix URL normalization for headless redirect URI.
  • Fix an error with headlessMode and CP-based logins.
  • Fix LinkedIn provider and the v2 API.
  • Fix an error when using “Name” as a value for matching an existing user. This is now “Full Name”.
  • Fix control panel login not working correctly.

2.0.1 2024-05-14

Fixed

  • Fix an error with Salesforce.

2.0.0 2024-05-13

Added

  • Add improved session-handling for authorization and callback methods, to improve failed sessions in some cases.
  • Add IdentityServer4 provider.
  • Add Salesforce provider.
  • Add logging when a provider cannot be saved.

Changed

  • Now requires PHP 8.2.0+.
  • Now requires Craft 5.0.0+.

Fixed

  • Fix an error when uninstalling the plugin.
  • Fix Salesforce provider.
  • Fix Apple provider not saving.