Release v2.5.10 · ZL154/JellyfinSecurity

v2.5.10 — OIDC role & picture sync, real account lockout, empty-password gate

A features + hardening release focused on OIDC/SSO and account protection. In-place upgrade from any 2.5.x — no schema or data migration.

Role-based library access from your IdP (#65). Map each IdP group/role to the libraries it grants; on sign-in a user's enabled libraries become the union of all libraries granted by their matched roles (and "Enable all libraries" is turned off). Per-provider, with an admin-UI editor that lists your libraries. Works with identity providers that send a groups/roles claim (Authentik, Authelia, Keycloak, and similar) — note that Google does not send groups.
Profile-picture sync (#66). Optionally copy the IdP profile picture into the Jellyfin avatar on sign-in. Per-provider, reads the standard picture claim (overridable), fetched through the same SSRF egress guard as the other IdP calls, content-type-restricted and size-capped.
Always show the account chooser (per-provider). Adds prompt=select_account so the IdP shows its account picker instead of silently reusing an account already signed in to the IdP in the browser — useful on shared machines / households with multiple accounts.
"Block sign-in with an empty password" is now an admin-UI toggle (Settings → Security). It was previously settable only by hand-editing the config file.

Account lockout now covers password brute-force (#55). "Max failed attempts before lockout" previously only counted failed 2FA codes — wrong passwords now count toward it too, the lock is enforced before the password is checked, and a clear "temporarily locked" message is shown on the login page. Administrators are exempt by default (new toggle) so the lockout cannot be turned into a denial-of-service against the admin account; the per-IP brute-force ban still protects them.
Auto-created OIDC users could be signed into with an empty password (#68). Users provisioned on first OIDC sign-in were hardened with a random password, but on Jellyfin 10.11.9+ a subsequent internal save could overwrite the freshly-set hash, leaving the account empty-password-vulnerable. Fixed by preserving the hash. The empty-password gate above now also applies to every sign-in (not just OIDC/passkey users), so the "Block empty password" toggle protects pre-existing passwordless accounts too.
Stricter OIDC identity matching. A sign-in is refused when the IdP email matches more than one Jellyfin user (ambiguous), and an administrator account can never be resolved or auto-linked via an IdP-asserted email — admins must link OIDC explicitly from their Setup page (matched by the immutable sub).
Filled in missing translations across all 8 locales for several admin/setup strings that previously displayed raw keys in non-English UIs.

Supports Jellyfin 10.11.x (10.11.9 and newer).
263/263 tests pass on .NET 9 / Jellyfin 10.11.x. Sigstore-signed + SLSA build-provenance attested.