v2.5.5 - Security release

v2.5.5 — Security release.

What's fixed

• OIDC empty-password sign-in path (reported via Reddit by Throwaway-3586): newly auto-provisioned OIDC users were created without a password hash, which Jellyfin's default auth provider treats as accepting any password including empty. v2.5.5 sets a 256-bit random password on every OIDC-provisioned user at creation, so the empty-password sign-in is no longer accepted against new accounts.
• TOTP rotate endpoint now works end-to-end. Earlier versions had a bug that made /Setup/Totp/Rotate always reject the current code.
• General security hardening across the auth pipeline: OIDC token algorithm allowlist, OIDC discovery URL validation, recovery-code PBKDF2 iteration bump, email-OTP storage hardening, GeoIP path validation, log scrubbing, several small race fixes, and a handful of defence-in-depth changes.

New config option

• BlockEmptyPasswordLogin (default off). When true, the plugin rejects empty/whitespace passwords for all users at the auth boundary. Turn it on if you don't need Jellyfin's kiosk-mode "tap a user tile" passwordless sign-in. Defaults to off so existing family/kiosk Jellyfins keep working unchanged on upgrade.

Upgrade

• In-place. No schema breakage, no config changes required.
• 254/254 tests pass on .NET 9 / Jellyfin 10.11.10.
• The audit-log endpoint now requires a fresh step-up re-verification for admins — if that's inconvenient, lower StepUpLevel in plugin config.

Thanks to Throwaway-3586 for the report.