VibeNVR v1.31.0

🚀 Release v1.31.0

📝 Summary

This minor release introduces native Single Sign-On (SSO / OAuth 2.0) integration into VibeNVR, bringing enterprise-grade identity management to your deployments. Alongside these major authentication features, we have patched a critical security vulnerability affecting webhook transmissions.

🛠️ Key Improvements

• 🚀 Authentication (SSO & OIDC): Introduced full support for OAuth 2.0 and OpenID Connect. You can now link your VibeNVR local accounts to external Identity Providers (such as Authentik, Keycloak, or Google Workspace) using a strict Zero-Trust subject mapping.
• ✨ SSO Auto-Redirect & RP-Logout: Added the ability to enable Auto-Redirect, which seamlessly bypasses the local login screen to immediately prompt your IdP. We also introduced RP-Initiated Logout, ensuring that logging out of VibeNVR securely terminates your session at the provider level.
• 🛡️ Security (Webhooks): Fixed a HIGH severity Server-Side Request Forgery (SSRF) bypass in webhook transmissions. The engine now explicitly blocks malicious redirects to internal IP addresses (e.g., Cloud Metadata).

🙌 Contributors

• @spupuz: 🛡️ Fixed the critical SSRF vulnerability in webhooks (PR #230) and championed the new SSO architecture.