Skip to content

SmartLogin v1.0.1-BETA — Security Hardening Hotfix

Pre-release
Pre-release

Choose a tag to compare

View all tags
@dr8553097-sudo dr8553097-sudo released this 13 Sep 16:55
· 2 commits to main since this release
v1.0.1-BETA
ddfa709

🛡️ SmartLogin v1.0.1-BETA — Security Hardening Hotfix

This release addresses important security findings and hardens critical authentication pipelines:

🔒 Security Fixes & Hardening:

  • 2FA Setup Authentication Enforcement: Fixed unauthenticated bypass where players could execute /2fa setup without first proving password ownership.
  • Login Brute-Force Rate Limiting: Implemented server-side attempt tracking, kicking users and broadcasting Discord security alerts upon exceeding max failed password attempts (default: 3).
  • Recovery OTP Rate Limiting: Active OTP password reset sessions are now invalidated immediately after 3 failed attempts to prevent brute-forcing.
  • TOTP Verification Drift Window: Tightened default TOTP validation window to RFC 6238 standard (±1 step, 30s drift).

📦 Artifacts:

  • Binary: SmartLogin-1.0.0.jar (Shaded with BouncyCastle Argon2id & ZXing QR Core).
  • Compatibility: Paper / Purpur 1.21+ | Java 21.
Assets 4
Loading