Updated the frontend build toolchain to Vite 8.3.4.
2.0.27 2026-10-17
Fixed
Fixed authentication provider class references that could fail on case-sensitive filesystems.
2.0.26 2026-10-15
Changed
Hardened email-based account matching.
Updated Craft API usage to avoid deprecated calls.
Fixed
Fixed a medium-severity authentication vulnerability.
2.0.25 2026-10-08
Added
Add provider connection controls to your own Craft account screen. (#52(opens new window))
Add opt-in Microsoft Entra tenant email matching for managed members in explicitly allowed, tenant-verified domains.
Add a control-panel notice and account ownership review for provider accounts connected to multiple Craft users. (#60(opens new window))
Fixed
Fix inactive duplicate users being created when an existing account cannot be matched to a provider email. (#52(opens new window))
Fix provider callback feedback not appearing when returning to the control panel. (#52(opens new window))
Fix legacy provider connection conflicts blocking plugin updates. Migrations preserve ambiguous connections for administrator review, including on previously upgraded sites, while unaffected accounts continue to sign in. (#60(opens new window))
2.0.24 2026-10-07
Changed
Require Verbb Base 3.0.20 or later so shared control-panel layouts use the current asset bundle namespace. (verbb-base#3(opens new window))
2.0.23 2026-10-05
Fixed
Fixed a medium-severity resource exhaustion vulnerability.
Fixed a low-severity information exposure vulnerability.
Fixed a low-severity sensitive data exposure vulnerability.
2.0.22 2026-10-02
Changed
Updated the required version of verbb/base to 3.0.19.
Shopify is now connection-only and can no longer be used for login or registration. Sites relying on Shopify login must provide another login method.
Fixed
Fixed a medium-severity authentication vulnerability.
Fixed a low-severity path traversal vulnerability.
Fixed a low-severity request integrity vulnerability.
Fixed a low-severity server-side request forgery vulnerability.
Fixed a low-severity sensitive information exposure vulnerability.
2.0.21 2026-09-30
Changed
Identify returning users by their provider connection, and limit first-time account matching to a verified email or provider ID.
Enforce one Craft user per provider account. Existing cross-user connection conflicts must be resolved before the plugin migration can finish.
Require a specific Azure or Microsoft Entra tenant, or an expected Salesforce organization, for automatic administrator registration.
Restrict provider configuration to administrators, and require allowAdminChanges for updates.
Route plugin settings through the plugin’s authorized settings controller.
Fixed
Fixed a high-severity account-linking vulnerability.
Fixed a high-severity authorization vulnerability.
Fixed the provider identity migration failing when the plugin connection table does not exist.
Fixed OAuth callback transaction validation.
Fixed OAuth login and disconnect accepting unsigned external return URLs.
2.0.20 2026-09-14
Changed
Align documentation filenames with page titles and update internal links.
Updated documentation for clearer, more consistent guidance.
Clarified optional PHP configuration with focused examples and linkable setting details.
Fixed
Fix the providers admin table after settings normalization.
2.0.19 2026-09-13
Changed
Normalize plugin settings.
2.0.18 2026-09-04
Fixed
Fix SSO buttons being clipped in Craft’s session-expired login modal by resizing the Garnish modal after inject. #58.
2.0.17 2026-08-29
Added
Add enableCpElevatedLogin config setting to opt back into SSO buttons in Craft’s elevated-session “Confirm your identity” modal. #58.
Fixed
Fix SSO buttons still appearing in Craft’s elevated-session “Confirm your identity” modal (including after validation errors and during MFA). #58.
2.0.16 2026-08-20
Fixed
Fix control panel social login not respecting the “Stay signed in” checkbox.
Fix SSO buttons appearing in Craft’s elevated-session “Confirm your identity” modal. #58.
2.0.15 2026-07-15
Changed
Bump verbb/auth.
Fixed
Fix front-end login failing on detached CP installs.
2.0.14 2026-05-03
Changed
Bump verbb/auth to allow firebase/php-jwt 7.x.
2.0.13 2026-03-28
Added
Add the ability for some providers to allow admin registration.
Add the ability to override the default Redirect URI as a plugin setting.
Fixed
Fix an error when trying to resume a session for a user.
2.0.12 2025-11-29
Changed
Bump verbb/auth.
Fixed
Fix inactive users being able to login.
2.0.11 2025-11-06
Changed
Bump verbb/auth.
2.0.10 2025-07-18
Changed
Update English translations.
2.0.9 2025-05-01
Fixed
Fix an error when logging errors for unsupported email providers.
Fix status indicator for various UI elements.
Fix compatibility with Craft 5.2+ and the session-expired login modal.
2.0.8 2025-04-12
Fixed
Fix compatibility with Craft 5.2+ and the session-expired login modal.
Fix an error for some providers (GitHub, GitLab, PayPal).
2.0.7 2024-09-14
Added
Add Microsoft Entra provider.
2.0.6 2024-09-07
Added
Add the ability to set the endpoint version for Azure provider.
2.0.5 2024-08-11
Changed
CP Login templates now are wrapped with a .social-login-cp-container div.
Update syncProfile to be disabled by default.
Update English translations.
Fixed
Fix custom CP login template not resolving correctly.
Fix HubSpot default scopes.
2.0.4 2024-07-17
Fixed
Fix an error with Amazon Cognito provider.
2.0.3 2024-07-15
Added
Add sendActivationEmail plugin setting.
Add the ability to set data for a login request, where users might want to store extra information.
Add Amazon Cognito provider.
Changed
Revert callback URI change for cpTrigger = null (for detached CPs).
Fixed
Fix race conditions with plugin initialization. (thanks @nfourtythree).
Fix activation email logic.
2.0.2 2024-05-29
Added
Added a new Plugin setting for syncing user profiles for existing accounts (thanks @SwiseWeb).
Add the ability to set data for a login request, where users might want to store extra information.
Changed
Update English translations.
Fixed
Fix URL normalization for headless redirect URI.
Fix an error with headlessMode and CP-based logins.
Fix LinkedIn provider and the v2 API.
Fix an error when using “Name” as a value for matching an existing user. This is now “Full Name”.
Fix control panel login not working correctly.
2.0.1 2024-05-14
Fixed
Fix an error with Salesforce.
2.0.0 2024-05-13
Added
Add improved session-handling for authorization and callback methods, to improve failed sessions in some cases.