# AuthMe 6.0.1 A maintenance release for the 6.x line. It closes several session-handling holes in the Paper and Folia builds, hardens the proxy and premium bypass paths, and adds a new hash algorithm, a new converter and a new API method. **If you run the Paper or Folia jar with pre-join dialogs enabled, update as soon as you can.** See the security section below. Full changelog: <https://github.com/AuthMe/AuthMeReloaded/compare/6.0.0...6.0.1> --- ## Security fixes ### Pre-join session takeover on Paper and Folia This affects the **Paper 1.21+** and **Folia 1.21+** builds on offline-mode servers, when the pre-join login/registration dialog is in use. The transient state of a pre-join dialog (the password being typed, the registration data, the recovery email, the pending kick message, the force-login future) was stored under the player's UUID. On an offline-mode server, every connection using the same name resolves to the same offline UUID. That meant a second connection opened on a registered player's name shared the state of the connection that was still authenticating, and could read it or wipe it. Three changes fix this: - **Pre-join state is now keyed by connection session** instead of by player name or profile id. Opening a session for a new connection discards the state of any earlier session for that name, so it can never be inherited, and the state is consumed in one go so nothing is left half-read. ([`39eed4e`](https://github.com/AuthMe/AuthMeReloaded/commit/39eed4e1b5d267ff2350d5d4a21c91f82c31efb2)) - **A connection now claims the player name while it is still being established**, before the play state. The new `PendingConnectionRegistry` holds the name for the login or registration timeout plus a short grace period. A second connection on the same name gets the "already online" message instead of racing the first one. The single-session check also runs again during the configuration phase, not only during login. Claims expire on a TTL and are released on join or on disconnect, so a name can never stay locked out. ([`098ef5e`](https://github.com/AuthMe/AuthMeReloaded/commit/098ef5eb0e7b30f5aecbb4ba8e20166c59eb1469)) - **A pre-join connection whose name claim was taken over is now denied** instead of being allowed to continue. ([`8b41f72`](https://github.com/AuthMe/AuthMeReloaded/commit/8b41f72e)) ### Proxy auto-login with an unset shared secret Leaving `Hooks.proxySharedSecret` empty on a backend used to run HMAC verification anyway, with the empty string as the key. That offered no real protection against forged `perform.login` messages. An empty secret now **rejects every `perform.login` message** and logs `Hooks.proxySharedSecret is not configured`. ([`5722849`](https://github.com/AuthMe/AuthMeReloaded/commit/5722849c)) If you rely on proxy auto-login, copy the proxy-generated secret to every backend before updating. See [proxy configuration](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/proxies/configuration.md). ### Premium claims accepted while premium was disabled The proxy login validator had no `enablePremium` gate. A proxy-verified premium claim for a player whose database row still carried a `premiumUuid` was accepted even after the feature had been turned off on the backend. On top of that, the `proxy.started` handler skipped sending the premium list when it was empty, so the proxy kept a stale `premium_names.cache` and went on verifying enrolled players. Both paths are now gated on the setting, and an empty list is sent as authoritative so the proxy replaces and persists its cache on first contact instead of waiting for a restart. ([`0f148bf`](https://github.com/AuthMe/AuthMeReloaded/commit/0f148bf6), [`5bae6ee`](https://github.com/AuthMe/AuthMeReloaded/commit/5bae6ee2), [#3127](https://github.com/AuthMe/AuthMeReloaded/issues/3127)) --- ## New features ### ARGON2ID hash algorithm `ARGON2ID` is now available as a recommended `passwordHash` value. The recent hash implementations have also moved to BouncyCastle. See the [hash algorithms reference](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/hash_algorithms.md). ### NexAuth converter You can now migrate accounts from **NexAuth** with `/authme converter nexauth`. The converter reads `plugins/NexAuth/config.conf` to work out the storage backend. SQLite is read directly, so no shared database is needed, and MySQL and PostgreSQL are supported too. Premium UUIDs and TOTP secrets are preserved, and players already present in AuthMe are skipped. See the [converters guide](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/converters.md). Note that the LibreLogin converter now maps `Argon2-ID` to `ARGON2ID` rather than `ARGON2`. ### `premium.keepOfflineUuidCompatibility` on the proxy plugins A new proxy-side flag controls how premium players appear to backend servers. With the default `false`, premium players keep their Mojang UUID v4. With `true`, they keep the backend offline UUID v3 for plugin compatibility. Velocity handles both modes natively. On BungeeCord, PacketEvents is only needed when the flag is `true`. ### `AuthMeApi#forceLoginFromProxy(String)` A new API method that lets proxy plugins force a login before the `Player` object exists, which bypasses the Paper/Folia pre-join dialog. Queue-first ordering keeps it race-safe against `AsynchronousJoin`. Completion is asynchronous, and the caller is responsible for authenticating the proxy signal. ([#3118](https://github.com/AuthMe/AuthMeReloaded/issues/3118)) ### Cancellation messages Dialog cancellation now has its own translatable messages. The Tatar translation has been updated as well. --- ## Bug fixes ### Premium and proxy - Premium enrollment is finalized in-join on the v3/proxy path in offline-UUID mode, using the same one-shot gate as the login validator. No more double finalization or spurious "premium verification failed" messages. - Fixed premium cache handling on the proxy side - Premium names sent to the proxy are normalized - Pending state is held during premium verification, and a failed attempt now allows a reconnect so `/login` can be enforced - Auto-login carries through to whichever server the player joins next - Hardened `perform.login` handling during server transitions - A pending kick is applied after session or proxy auto-login verification, not before - Players no longer freeze after `/freemium` when proxy auto-login is active ([#3105](https://github.com/AuthMe/AuthMeReloaded/issues/3105)) - Ender pearls are restored for premium users - Premium profile creation no longer uses a deprecated API ### Dialogs - The pre-join login dialog is suppressed through config-phase auto-login when the player is already authenticated ([#3098](https://github.com/AuthMe/AuthMeReloaded/issues/3098)) - Players who cancel the login or registration dialog are kicked correctly when that option is enabled - The pre-join dialog is cancelled correctly on failure and on the cancel button - `maxRegPerIp` is now checked in the pre-join dialog workflow - The premium handshake is deferred if the first player to join cancels the dialog ### General - Walk and fly speed are restored correctly on quit, and corrupted speed values are repaired on join - Email verification codes are only registered once the email has actually been sent - Players are no longer teleported to 0,0,0 after a `resetpos` --- ## Breaking changes **PermissionsEx and zPermissions support has been removed.** Both have been unmaintained for years. Move to LuckPerms or another supported permissions plugin before updating. **`Hooks.proxySharedSecret` is now mandatory for proxy auto-login.** An empty value no longer falls back to an empty HMAC key. It rejects every `perform.login` message. --- ## Internal - JUnit 5 cleanup across the `output`, `permission`, `process`, `security`, `service`, `settings`, `task` and `util` packages ([#3106](https://github.com/AuthMe/AuthMeReloaded/issues/3106)) - Dependency updates --- ## Additional resources - [Configuration reference](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/config.md) - [Commands and permissions](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/commands.md) - [Hash algorithms](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/hash_algorithms.md) - [Converters](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/converters.md) - [Translations](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/translations.md) - [Premium bypass](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/premium.md) - [Proxy configuration](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/proxies/configuration.md)

# AuthMe 6.0.1 A maintenance release for the 6.x line. It closes several session-handling holes in the Paper and Folia builds, hardens the proxy and premium bypass paths, and adds a new hash algorithm, a new converter and a new API method. **If you run the Paper or Folia jar with pre-join dialogs enabled, update as soon as you can.** See the security section below. Full changelog: <https://github.com/AuthMe/AuthMeReloaded/compare/6.0.0...6.0.1> --- ## Security fixes ### Pre-join session takeover on Paper and Folia This affects the **Paper 1.21+** and **Folia 1.21+** builds on offline-mode servers, when the pre-join login/registration dialog is in use. The transient state of a pre-join dialog (the password being typed, the registration data, the recovery email, the pending kick message, the force-login future) was stored under the player's UUID. On an offline-mode server, every connection using the same name resolves to the same offline UUID. That meant a second connection opened on a registered player's name shared the state of the connection that was still authenticating, and could read it or wipe it. Three changes fix this: - **Pre-join state is now keyed by connection session** instead of by player name or profile id. Opening a session for a new connection discards the state of any earlier session for that name, so it can never be inherited, and the state is consumed in one go so nothing is left half-read. ([`39eed4e`](https://github.com/AuthMe/AuthMeReloaded/commit/39eed4e1b5d267ff2350d5d4a21c91f82c31efb2)) - **A connection now claims the player name while it is still being established**, before the play state. The new `PendingConnectionRegistry` holds the name for the login or registration timeout plus a short grace period. A second connection on the same name gets the "already online" message instead of racing the first one. The single-session check also runs again during the configuration phase, not only during login. Claims expire on a TTL and are released on join or on disconnect, so a name can never stay locked out. ([`098ef5e`](https://github.com/AuthMe/AuthMeReloaded/commit/098ef5eb0e7b30f5aecbb4ba8e20166c59eb1469)) - **A pre-join connection whose name claim was taken over is now denied** instead of being allowed to continue. ([`8b41f72`](https://github.com/AuthMe/AuthMeReloaded/commit/8b41f72e)) ### Proxy auto-login with an unset shared secret Leaving `Hooks.proxySharedSecret` empty on a backend used to run HMAC verification anyway, with the empty string as the key. That offered no real protection against forged `perform.login` messages. An empty secret now **rejects every `perform.login` message** and logs `Hooks.proxySharedSecret is not configured`. ([`5722849`](https://github.com/AuthMe/AuthMeReloaded/commit/5722849c)) If you rely on proxy auto-login, copy the proxy-generated secret to every backend before updating. See [proxy configuration](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/proxies/configuration.md). ### Premium claims accepted while premium was disabled The proxy login validator had no `enablePremium` gate. A proxy-verified premium claim for a player whose database row still carried a `premiumUuid` was accepted even after the feature had been turned off on the backend. On top of that, the `proxy.started` handler skipped sending the premium list when it was empty, so the proxy kept a stale `premium_names.cache` and went on verifying enrolled players. Both paths are now gated on the setting, and an empty list is sent as authoritative so the proxy replaces and persists its cache on first contact instead of waiting for a restart. ([`0f148bf`](https://github.com/AuthMe/AuthMeReloaded/commit/0f148bf6), [`5bae6ee`](https://github.com/AuthMe/AuthMeReloaded/commit/5bae6ee2), [#3127](https://github.com/AuthMe/AuthMeReloaded/issues/3127)) --- ## New features ### ARGON2ID hash algorithm `ARGON2ID` is now available as a recommended `passwordHash` value. The recent hash implementations have also moved to BouncyCastle. See the [hash algorithms reference](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/hash_algorithms.md). ### NexAuth converter You can now migrate accounts from **NexAuth** with `/authme converter nexauth`. The converter reads `plugins/NexAuth/config.conf` to work out the storage backend. SQLite is read directly, so no shared database is needed, and MySQL and PostgreSQL are supported too. Premium UUIDs and TOTP secrets are preserved, and players already present in AuthMe are skipped. See the [converters guide](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/converters.md). Note that the LibreLogin converter now maps `Argon2-ID` to `ARGON2ID` rather than `ARGON2`. ### `premium.keepOfflineUuidCompatibility` on the proxy plugins A new proxy-side flag controls how premium players appear to backend servers. With the default `false`, premium players keep their Mojang UUID v4. With `true`, they keep the backend offline UUID v3 for plugin compatibility. Velocity handles both modes natively. On BungeeCord, PacketEvents is only needed when the flag is `true`. ### `AuthMeApi#forceLoginFromProxy(String)` A new API method that lets proxy plugins force a login before the `Player` object exists, which bypasses the Paper/Folia pre-join dialog. Queue-first ordering keeps it race-safe against `AsynchronousJoin`. Completion is asynchronous, and the caller is responsible for authenticating the proxy signal. ([#3118](https://github.com/AuthMe/AuthMeReloaded/issues/3118)) ### Cancellation messages Dialog cancellation now has its own translatable messages. The Tatar translation has been updated as well. --- ## Bug fixes ### Premium and proxy - Premium enrollment is finalized in-join on the v3/proxy path in offline-UUID mode, using the same one-shot gate as the login validator. No more double finalization or spurious "premium verification failed" messages. - Fixed premium cache handling on the proxy side - Premium names sent to the proxy are normalized - Pending state is held during premium verification, and a failed attempt now allows a reconnect so `/login` can be enforced - Auto-login carries through to whichever server the player joins next - Hardened `perform.login` handling during server transitions - A pending kick is applied after session or proxy auto-login verification, not before - Players no longer freeze after `/freemium` when proxy auto-login is active ([#3105](https://github.com/AuthMe/AuthMeReloaded/issues/3105)) - Ender pearls are restored for premium users - Premium profile creation no longer uses a deprecated API ### Dialogs - The pre-join login dialog is suppressed through config-phase auto-login when the player is already authenticated ([#3098](https://github.com/AuthMe/AuthMeReloaded/issues/3098)) - Players who cancel the login or registration dialog are kicked correctly when that option is enabled - The pre-join dialog is cancelled correctly on failure and on the cancel button - `maxRegPerIp` is now checked in the pre-join dialog workflow - The premium handshake is deferred if the first player to join cancels the dialog ### General - Walk and fly speed are restored correctly on quit, and corrupted speed values are repaired on join - Email verification codes are only registered once the email has actually been sent - Players are no longer teleported to 0,0,0 after a `resetpos` --- ## Breaking changes **PermissionsEx and zPermissions support has been removed.** Both have been unmaintained for years. Move to LuckPerms or another supported permissions plugin before updating. **`Hooks.proxySharedSecret` is now mandatory for proxy auto-login.** An empty value no longer falls back to an empty HMAC key. It rejects every `perform.login` message. --- ## Internal - JUnit 5 cleanup across the `output`, `permission`, `process`, `security`, `service`, `settings`, `task` and `util` packages ([#3106](https://github.com/AuthMe/AuthMeReloaded/issues/3106)) - Dependency updates --- ## Additional resources - [Configuration reference](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/config.md) - [Commands and permissions](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/commands.md) - [Hash algorithms](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/hash_algorithms.md) - [Converters](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/converters.md) - [Translations](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/translations.md) - [Premium bypass](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/premium.md) - [Proxy configuration](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/proxies/configuration.md)

# AuthMe 6.0.1 A maintenance release for the 6.x line. It closes several session-handling holes in the Paper and Folia builds, hardens the proxy and premium bypass paths, and adds a new hash algorithm, a new converter and a new API method. **If you run the Paper or Folia jar with pre-join dialogs enabled, update as soon as you can.** See the security section below. Full changelog: <https://github.com/AuthMe/AuthMeReloaded/compare/6.0.0...6.0.1> --- ## Security fixes ### Pre-join session takeover on Paper and Folia This affects the **Paper 1.21+** and **Folia 1.21+** builds on offline-mode servers, when the pre-join login/registration dialog is in use. The transient state of a pre-join dialog (the password being typed, the registration data, the recovery email, the pending kick message, the force-login future) was stored under the player's UUID. On an offline-mode server, every connection using the same name resolves to the same offline UUID. That meant a second connection opened on a registered player's name shared the state of the connection that was still authenticating, and could read it or wipe it. Three changes fix this: - **Pre-join state is now keyed by connection session** instead of by player name or profile id. Opening a session for a new connection discards the state of any earlier session for that name, so it can never be inherited, and the state is consumed in one go so nothing is left half-read. ([`39eed4e`](https://github.com/AuthMe/AuthMeReloaded/commit/39eed4e1b5d267ff2350d5d4a21c91f82c31efb2)) - **A connection now claims the player name while it is still being established**, before the play state. The new `PendingConnectionRegistry` holds the name for the login or registration timeout plus a short grace period. A second connection on the same name gets the "already online" message instead of racing the first one. The single-session check also runs again during the configuration phase, not only during login. Claims expire on a TTL and are released on join or on disconnect, so a name can never stay locked out. ([`098ef5e`](https://github.com/AuthMe/AuthMeReloaded/commit/098ef5eb0e7b30f5aecbb4ba8e20166c59eb1469)) - **A pre-join connection whose name claim was taken over is now denied** instead of being allowed to continue. ([`8b41f72`](https://github.com/AuthMe/AuthMeReloaded/commit/8b41f72e)) ### Proxy auto-login with an unset shared secret Leaving `Hooks.proxySharedSecret` empty on a backend used to run HMAC verification anyway, with the empty string as the key. That offered no real protection against forged `perform.login` messages. An empty secret now **rejects every `perform.login` message** and logs `Hooks.proxySharedSecret is not configured`. ([`5722849`](https://github.com/AuthMe/AuthMeReloaded/commit/5722849c)) If you rely on proxy auto-login, copy the proxy-generated secret to every backend before updating. See [proxy configuration](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/proxies/configuration.md). ### Premium claims accepted while premium was disabled The proxy login validator had no `enablePremium` gate. A proxy-verified premium claim for a player whose database row still carried a `premiumUuid` was accepted even after the feature had been turned off on the backend. On top of that, the `proxy.started` handler skipped sending the premium list when it was empty, so the proxy kept a stale `premium_names.cache` and went on verifying enrolled players. Both paths are now gated on the setting, and an empty list is sent as authoritative so the proxy replaces and persists its cache on first contact instead of waiting for a restart. ([`0f148bf`](https://github.com/AuthMe/AuthMeReloaded/commit/0f148bf6), [`5bae6ee`](https://github.com/AuthMe/AuthMeReloaded/commit/5bae6ee2), [#3127](https://github.com/AuthMe/AuthMeReloaded/issues/3127)) --- ## New features ### ARGON2ID hash algorithm `ARGON2ID` is now available as a recommended `passwordHash` value. The recent hash implementations have also moved to BouncyCastle. See the [hash algorithms reference](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/hash_algorithms.md). ### NexAuth converter You can now migrate accounts from **NexAuth** with `/authme converter nexauth`. The converter reads `plugins/NexAuth/config.conf` to work out the storage backend. SQLite is read directly, so no shared database is needed, and MySQL and PostgreSQL are supported too. Premium UUIDs and TOTP secrets are preserved, and players already present in AuthMe are skipped. See the [converters guide](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/converters.md). Note that the LibreLogin converter now maps `Argon2-ID` to `ARGON2ID` rather than `ARGON2`. ### `premium.keepOfflineUuidCompatibility` on the proxy plugins A new proxy-side flag controls how premium players appear to backend servers. With the default `false`, premium players keep their Mojang UUID v4. With `true`, they keep the backend offline UUID v3 for plugin compatibility. Velocity handles both modes natively. On BungeeCord, PacketEvents is only needed when the flag is `true`. ### `AuthMeApi#forceLoginFromProxy(String)` A new API method that lets proxy plugins force a login before the `Player` object exists, which bypasses the Paper/Folia pre-join dialog. Queue-first ordering keeps it race-safe against `AsynchronousJoin`. Completion is asynchronous, and the caller is responsible for authenticating the proxy signal. ([#3118](https://github.com/AuthMe/AuthMeReloaded/issues/3118)) ### Cancellation messages Dialog cancellation now has its own translatable messages. The Tatar translation has been updated as well. --- ## Bug fixes ### Premium and proxy - Premium enrollment is finalized in-join on the v3/proxy path in offline-UUID mode, using the same one-shot gate as the login validator. No more double finalization or spurious "premium verification failed" messages. - Fixed premium cache handling on the proxy side - Premium names sent to the proxy are normalized - Pending state is held during premium verification, and a failed attempt now allows a reconnect so `/login` can be enforced - Auto-login carries through to whichever server the player joins next - Hardened `perform.login` handling during server transitions - A pending kick is applied after session or proxy auto-login verification, not before - Players no longer freeze after `/freemium` when proxy auto-login is active ([#3105](https://github.com/AuthMe/AuthMeReloaded/issues/3105)) - Ender pearls are restored for premium users - Premium profile creation no longer uses a deprecated API ### Dialogs - The pre-join login dialog is suppressed through config-phase auto-login when the player is already authenticated ([#3098](https://github.com/AuthMe/AuthMeReloaded/issues/3098)) - Players who cancel the login or registration dialog are kicked correctly when that option is enabled - The pre-join dialog is cancelled correctly on failure and on the cancel button - `maxRegPerIp` is now checked in the pre-join dialog workflow - The premium handshake is deferred if the first player to join cancels the dialog ### General - Walk and fly speed are restored correctly on quit, and corrupted speed values are repaired on join - Email verification codes are only registered once the email has actually been sent - Players are no longer teleported to 0,0,0 after a `resetpos` --- ## Breaking changes **PermissionsEx and zPermissions support has been removed.** Both have been unmaintained for years. Move to LuckPerms or another supported permissions plugin before updating. **`Hooks.proxySharedSecret` is now mandatory for proxy auto-login.** An empty value no longer falls back to an empty HMAC key. It rejects every `perform.login` message. --- ## Internal - JUnit 5 cleanup across the `output`, `permission`, `process`, `security`, `service`, `settings`, `task` and `util` packages ([#3106](https://github.com/AuthMe/AuthMeReloaded/issues/3106)) - Dependency updates --- ## Additional resources - [Configuration reference](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/config.md) - [Commands and permissions](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/commands.md) - [Hash algorithms](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/hash_algorithms.md) - [Converters](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/converters.md) - [Translations](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/translations.md) - [Premium bypass](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/premium.md) - [Proxy configuration](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/proxies/configuration.md)

# AuthMe 6.0.1 A maintenance release for the 6.x line. It closes several session-handling holes in the Paper and Folia builds, hardens the proxy and premium bypass paths, and adds a new hash algorithm, a new converter and a new API method. **If you run the Paper or Folia jar with pre-join dialogs enabled, update as soon as you can.** See the security section below. Full changelog: <https://github.com/AuthMe/AuthMeReloaded/compare/6.0.0...6.0.1> --- ## Security fixes ### Pre-join session takeover on Paper and Folia This affects the **Paper 1.21+** and **Folia 1.21+** builds on offline-mode servers, when the pre-join login/registration dialog is in use. The transient state of a pre-join dialog (the password being typed, the registration data, the recovery email, the pending kick message, the force-login future) was stored under the player's UUID. On an offline-mode server, every connection using the same name resolves to the same offline UUID. That meant a second connection opened on a registered player's name shared the state of the connection that was still authenticating, and could read it or wipe it. Three changes fix this: - **Pre-join state is now keyed by connection session** instead of by player name or profile id. Opening a session for a new connection discards the state of any earlier session for that name, so it can never be inherited, and the state is consumed in one go so nothing is left half-read. ([`39eed4e`](https://github.com/AuthMe/AuthMeReloaded/commit/39eed4e1b5d267ff2350d5d4a21c91f82c31efb2)) - **A connection now claims the player name while it is still being established**, before the play state. The new `PendingConnectionRegistry` holds the name for the login or registration timeout plus a short grace period. A second connection on the same name gets the "already online" message instead of racing the first one. The single-session check also runs again during the configuration phase, not only during login. Claims expire on a TTL and are released on join or on disconnect, so a name can never stay locked out. ([`098ef5e`](https://github.com/AuthMe/AuthMeReloaded/commit/098ef5eb0e7b30f5aecbb4ba8e20166c59eb1469)) - **A pre-join connection whose name claim was taken over is now denied** instead of being allowed to continue. ([`8b41f72`](https://github.com/AuthMe/AuthMeReloaded/commit/8b41f72e)) ### Proxy auto-login with an unset shared secret Leaving `Hooks.proxySharedSecret` empty on a backend used to run HMAC verification anyway, with the empty string as the key. That offered no real protection against forged `perform.login` messages. An empty secret now **rejects every `perform.login` message** and logs `Hooks.proxySharedSecret is not configured`. ([`5722849`](https://github.com/AuthMe/AuthMeReloaded/commit/5722849c)) If you rely on proxy auto-login, copy the proxy-generated secret to every backend before updating. See [proxy configuration](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/proxies/configuration.md). ### Premium claims accepted while premium was disabled The proxy login validator had no `enablePremium` gate. A proxy-verified premium claim for a player whose database row still carried a `premiumUuid` was accepted even after the feature had been turned off on the backend. On top of that, the `proxy.started` handler skipped sending the premium list when it was empty, so the proxy kept a stale `premium_names.cache` and went on verifying enrolled players. Both paths are now gated on the setting, and an empty list is sent as authoritative so the proxy replaces and persists its cache on first contact instead of waiting for a restart. ([`0f148bf`](https://github.com/AuthMe/AuthMeReloaded/commit/0f148bf6), [`5bae6ee`](https://github.com/AuthMe/AuthMeReloaded/commit/5bae6ee2), [#3127](https://github.com/AuthMe/AuthMeReloaded/issues/3127)) --- ## New features ### ARGON2ID hash algorithm `ARGON2ID` is now available as a recommended `passwordHash` value. The recent hash implementations have also moved to BouncyCastle. See the [hash algorithms reference](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/hash_algorithms.md). ### NexAuth converter You can now migrate accounts from **NexAuth** with `/authme converter nexauth`. The converter reads `plugins/NexAuth/config.conf` to work out the storage backend. SQLite is read directly, so no shared database is needed, and MySQL and PostgreSQL are supported too. Premium UUIDs and TOTP secrets are preserved, and players already present in AuthMe are skipped. See the [converters guide](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/converters.md). Note that the LibreLogin converter now maps `Argon2-ID` to `ARGON2ID` rather than `ARGON2`. ### `premium.keepOfflineUuidCompatibility` on the proxy plugins A new proxy-side flag controls how premium players appear to backend servers. With the default `false`, premium players keep their Mojang UUID v4. With `true`, they keep the backend offline UUID v3 for plugin compatibility. Velocity handles both modes natively. On BungeeCord, PacketEvents is only needed when the flag is `true`. ### `AuthMeApi#forceLoginFromProxy(String)` A new API method that lets proxy plugins force a login before the `Player` object exists, which bypasses the Paper/Folia pre-join dialog. Queue-first ordering keeps it race-safe against `AsynchronousJoin`. Completion is asynchronous, and the caller is responsible for authenticating the proxy signal. ([#3118](https://github.com/AuthMe/AuthMeReloaded/issues/3118)) ### Cancellation messages Dialog cancellation now has its own translatable messages. The Tatar translation has been updated as well. --- ## Bug fixes ### Premium and proxy - Premium enrollment is finalized in-join on the v3/proxy path in offline-UUID mode, using the same one-shot gate as the login validator. No more double finalization or spurious "premium verification failed" messages. - Fixed premium cache handling on the proxy side - Premium names sent to the proxy are normalized - Pending state is held during premium verification, and a failed attempt now allows a reconnect so `/login` can be enforced - Auto-login carries through to whichever server the player joins next - Hardened `perform.login` handling during server transitions - A pending kick is applied after session or proxy auto-login verification, not before - Players no longer freeze after `/freemium` when proxy auto-login is active ([#3105](https://github.com/AuthMe/AuthMeReloaded/issues/3105)) - Ender pearls are restored for premium users - Premium profile creation no longer uses a deprecated API ### Dialogs - The pre-join login dialog is suppressed through config-phase auto-login when the player is already authenticated ([#3098](https://github.com/AuthMe/AuthMeReloaded/issues/3098)) - Players who cancel the login or registration dialog are kicked correctly when that option is enabled - The pre-join dialog is cancelled correctly on failure and on the cancel button - `maxRegPerIp` is now checked in the pre-join dialog workflow - The premium handshake is deferred if the first player to join cancels the dialog ### General - Walk and fly speed are restored correctly on quit, and corrupted speed values are repaired on join - Email verification codes are only registered once the email has actually been sent - Players are no longer teleported to 0,0,0 after a `resetpos` --- ## Breaking changes **PermissionsEx and zPermissions support has been removed.** Both have been unmaintained for years. Move to LuckPerms or another supported permissions plugin before updating. **`Hooks.proxySharedSecret` is now mandatory for proxy auto-login.** An empty value no longer falls back to an empty HMAC key. It rejects every `perform.login` message. --- ## Internal - JUnit 5 cleanup across the `output`, `permission`, `process`, `security`, `service`, `settings`, `task` and `util` packages ([#3106](https://github.com/AuthMe/AuthMeReloaded/issues/3106)) - Dependency updates --- ## Additional resources - [Configuration reference](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/config.md) - [Commands and permissions](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/commands.md) - [Hash algorithms](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/hash_algorithms.md) - [Converters](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/converters.md) - [Translations](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/translations.md) - [Premium bypass](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/premium.md) - [Proxy configuration](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/proxies/configuration.md)

# AuthMe 6.0.1 A maintenance release for the 6.x line. It closes several session-handling holes in the Paper and Folia builds, hardens the proxy and premium bypass paths, and adds a new hash algorithm, a new converter and a new API method. **If you run the Paper or Folia jar with pre-join dialogs enabled, update as soon as you can.** See the security section below. Full changelog: <https://github.com/AuthMe/AuthMeReloaded/compare/6.0.0...6.0.1> --- ## Security fixes ### Pre-join session takeover on Paper and Folia This affects the **Paper 1.21+** and **Folia 1.21+** builds on offline-mode servers, when the pre-join login/registration dialog is in use. The transient state of a pre-join dialog (the password being typed, the registration data, the recovery email, the pending kick message, the force-login future) was stored under the player's UUID. On an offline-mode server, every connection using the same name resolves to the same offline UUID. That meant a second connection opened on a registered player's name shared the state of the connection that was still authenticating, and could read it or wipe it. Three changes fix this: - **Pre-join state is now keyed by connection session** instead of by player name or profile id. Opening a session for a new connection discards the state of any earlier session for that name, so it can never be inherited, and the state is consumed in one go so nothing is left half-read. ([`39eed4e`](https://github.com/AuthMe/AuthMeReloaded/commit/39eed4e1b5d267ff2350d5d4a21c91f82c31efb2)) - **A connection now claims the player name while it is still being established**, before the play state. The new `PendingConnectionRegistry` holds the name for the login or registration timeout plus a short grace period. A second connection on the same name gets the "already online" message instead of racing the first one. The single-session check also runs again during the configuration phase, not only during login. Claims expire on a TTL and are released on join or on disconnect, so a name can never stay locked out. ([`098ef5e`](https://github.com/AuthMe/AuthMeReloaded/commit/098ef5eb0e7b30f5aecbb4ba8e20166c59eb1469)) - **A pre-join connection whose name claim was taken over is now denied** instead of being allowed to continue. ([`8b41f72`](https://github.com/AuthMe/AuthMeReloaded/commit/8b41f72e)) ### Proxy auto-login with an unset shared secret Leaving `Hooks.proxySharedSecret` empty on a backend used to run HMAC verification anyway, with the empty string as the key. That offered no real protection against forged `perform.login` messages. An empty secret now **rejects every `perform.login` message** and logs `Hooks.proxySharedSecret is not configured`. ([`5722849`](https://github.com/AuthMe/AuthMeReloaded/commit/5722849c)) If you rely on proxy auto-login, copy the proxy-generated secret to every backend before updating. See [proxy configuration](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/proxies/configuration.md). ### Premium claims accepted while premium was disabled The proxy login validator had no `enablePremium` gate. A proxy-verified premium claim for a player whose database row still carried a `premiumUuid` was accepted even after the feature had been turned off on the backend. On top of that, the `proxy.started` handler skipped sending the premium list when it was empty, so the proxy kept a stale `premium_names.cache` and went on verifying enrolled players. Both paths are now gated on the setting, and an empty list is sent as authoritative so the proxy replaces and persists its cache on first contact instead of waiting for a restart. ([`0f148bf`](https://github.com/AuthMe/AuthMeReloaded/commit/0f148bf6), [`5bae6ee`](https://github.com/AuthMe/AuthMeReloaded/commit/5bae6ee2), [#3127](https://github.com/AuthMe/AuthMeReloaded/issues/3127)) --- ## New features ### ARGON2ID hash algorithm `ARGON2ID` is now available as a recommended `passwordHash` value. The recent hash implementations have also moved to BouncyCastle. See the [hash algorithms reference](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/hash_algorithms.md). ### NexAuth converter You can now migrate accounts from **NexAuth** with `/authme converter nexauth`. The converter reads `plugins/NexAuth/config.conf` to work out the storage backend. SQLite is read directly, so no shared database is needed, and MySQL and PostgreSQL are supported too. Premium UUIDs and TOTP secrets are preserved, and players already present in AuthMe are skipped. See the [converters guide](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/converters.md). Note that the LibreLogin converter now maps `Argon2-ID` to `ARGON2ID` rather than `ARGON2`. ### `premium.keepOfflineUuidCompatibility` on the proxy plugins A new proxy-side flag controls how premium players appear to backend servers. With the default `false`, premium players keep their Mojang UUID v4. With `true`, they keep the backend offline UUID v3 for plugin compatibility. Velocity handles both modes natively. On BungeeCord, PacketEvents is only needed when the flag is `true`. ### `AuthMeApi#forceLoginFromProxy(String)` A new API method that lets proxy plugins force a login before the `Player` object exists, which bypasses the Paper/Folia pre-join dialog. Queue-first ordering keeps it race-safe against `AsynchronousJoin`. Completion is asynchronous, and the caller is responsible for authenticating the proxy signal. ([#3118](https://github.com/AuthMe/AuthMeReloaded/issues/3118)) ### Cancellation messages Dialog cancellation now has its own translatable messages. The Tatar translation has been updated as well. --- ## Bug fixes ### Premium and proxy - Premium enrollment is finalized in-join on the v3/proxy path in offline-UUID mode, using the same one-shot gate as the login validator. No more double finalization or spurious "premium verification failed" messages. - Fixed premium cache handling on the proxy side - Premium names sent to the proxy are normalized - Pending state is held during premium verification, and a failed attempt now allows a reconnect so `/login` can be enforced - Auto-login carries through to whichever server the player joins next - Hardened `perform.login` handling during server transitions - A pending kick is applied after session or proxy auto-login verification, not before - Players no longer freeze after `/freemium` when proxy auto-login is active ([#3105](https://github.com/AuthMe/AuthMeReloaded/issues/3105)) - Ender pearls are restored for premium users - Premium profile creation no longer uses a deprecated API ### Dialogs - The pre-join login dialog is suppressed through config-phase auto-login when the player is already authenticated ([#3098](https://github.com/AuthMe/AuthMeReloaded/issues/3098)) - Players who cancel the login or registration dialog are kicked correctly when that option is enabled - The pre-join dialog is cancelled correctly on failure and on the cancel button - `maxRegPerIp` is now checked in the pre-join dialog workflow - The premium handshake is deferred if the first player to join cancels the dialog ### General - Walk and fly speed are restored correctly on quit, and corrupted speed values are repaired on join - Email verification codes are only registered once the email has actually been sent - Players are no longer teleported to 0,0,0 after a `resetpos` --- ## Breaking changes **PermissionsEx and zPermissions support has been removed.** Both have been unmaintained for years. Move to LuckPerms or another supported permissions plugin before updating. **`Hooks.proxySharedSecret` is now mandatory for proxy auto-login.** An empty value no longer falls back to an empty HMAC key. It rejects every `perform.login` message. --- ## Internal - JUnit 5 cleanup across the `output`, `permission`, `process`, `security`, `service`, `settings`, `task` and `util` packages ([#3106](https://github.com/AuthMe/AuthMeReloaded/issues/3106)) - Dependency updates --- ## Additional resources - [Configuration reference](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/config.md) - [Commands and permissions](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/commands.md) - [Hash algorithms](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/hash_algorithms.md) - [Converters](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/converters.md) - [Translations](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/translations.md) - [Premium bypass](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/premium.md) - [Proxy configuration](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/proxies/configuration.md)

# AuthMe 6.0.1 A maintenance release for the 6.x line. It closes several session-handling holes in the Paper and Folia builds, hardens the proxy and premium bypass paths, and adds a new hash algorithm, a new converter and a new API method. **If you run the Paper or Folia jar with pre-join dialogs enabled, update as soon as you can.** See the security section below. Full changelog: <https://github.com/AuthMe/AuthMeReloaded/compare/6.0.0...6.0.1> --- ## Security fixes ### Pre-join session takeover on Paper and Folia This affects the **Paper 1.21+** and **Folia 1.21+** builds on offline-mode servers, when the pre-join login/registration dialog is in use. The transient state of a pre-join dialog (the password being typed, the registration data, the recovery email, the pending kick message, the force-login future) was stored under the player's UUID. On an offline-mode server, every connection using the same name resolves to the same offline UUID. That meant a second connection opened on a registered player's name shared the state of the connection that was still authenticating, and could read it or wipe it. Three changes fix this: - **Pre-join state is now keyed by connection session** instead of by player name or profile id. Opening a session for a new connection discards the state of any earlier session for that name, so it can never be inherited, and the state is consumed in one go so nothing is left half-read. ([`39eed4e`](https://github.com/AuthMe/AuthMeReloaded/commit/39eed4e1b5d267ff2350d5d4a21c91f82c31efb2)) - **A connection now claims the player name while it is still being established**, before the play state. The new `PendingConnectionRegistry` holds the name for the login or registration timeout plus a short grace period. A second connection on the same name gets the "already online" message instead of racing the first one. The single-session check also runs again during the configuration phase, not only during login. Claims expire on a TTL and are released on join or on disconnect, so a name can never stay locked out. ([`098ef5e`](https://github.com/AuthMe/AuthMeReloaded/commit/098ef5eb0e7b30f5aecbb4ba8e20166c59eb1469)) - **A pre-join connection whose name claim was taken over is now denied** instead of being allowed to continue. ([`8b41f72`](https://github.com/AuthMe/AuthMeReloaded/commit/8b41f72e)) ### Proxy auto-login with an unset shared secret Leaving `Hooks.proxySharedSecret` empty on a backend used to run HMAC verification anyway, with the empty string as the key. That offered no real protection against forged `perform.login` messages. An empty secret now **rejects every `perform.login` message** and logs `Hooks.proxySharedSecret is not configured`. ([`5722849`](https://github.com/AuthMe/AuthMeReloaded/commit/5722849c)) If you rely on proxy auto-login, copy the proxy-generated secret to every backend before updating. See [proxy configuration](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/proxies/configuration.md). ### Premium claims accepted while premium was disabled The proxy login validator had no `enablePremium` gate. A proxy-verified premium claim for a player whose database row still carried a `premiumUuid` was accepted even after the feature had been turned off on the backend. On top of that, the `proxy.started` handler skipped sending the premium list when it was empty, so the proxy kept a stale `premium_names.cache` and went on verifying enrolled players. Both paths are now gated on the setting, and an empty list is sent as authoritative so the proxy replaces and persists its cache on first contact instead of waiting for a restart. ([`0f148bf`](https://github.com/AuthMe/AuthMeReloaded/commit/0f148bf6), [`5bae6ee`](https://github.com/AuthMe/AuthMeReloaded/commit/5bae6ee2), [#3127](https://github.com/AuthMe/AuthMeReloaded/issues/3127)) --- ## New features ### ARGON2ID hash algorithm `ARGON2ID` is now available as a recommended `passwordHash` value. The recent hash implementations have also moved to BouncyCastle. See the [hash algorithms reference](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/hash_algorithms.md). ### NexAuth converter You can now migrate accounts from **NexAuth** with `/authme converter nexauth`. The converter reads `plugins/NexAuth/config.conf` to work out the storage backend. SQLite is read directly, so no shared database is needed, and MySQL and PostgreSQL are supported too. Premium UUIDs and TOTP secrets are preserved, and players already present in AuthMe are skipped. See the [converters guide](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/converters.md). Note that the LibreLogin converter now maps `Argon2-ID` to `ARGON2ID` rather than `ARGON2`. ### `premium.keepOfflineUuidCompatibility` on the proxy plugins A new proxy-side flag controls how premium players appear to backend servers. With the default `false`, premium players keep their Mojang UUID v4. With `true`, they keep the backend offline UUID v3 for plugin compatibility. Velocity handles both modes natively. On BungeeCord, PacketEvents is only needed when the flag is `true`. ### `AuthMeApi#forceLoginFromProxy(String)` A new API method that lets proxy plugins force a login before the `Player` object exists, which bypasses the Paper/Folia pre-join dialog. Queue-first ordering keeps it race-safe against `AsynchronousJoin`. Completion is asynchronous, and the caller is responsible for authenticating the proxy signal. ([#3118](https://github.com/AuthMe/AuthMeReloaded/issues/3118)) ### Cancellation messages Dialog cancellation now has its own translatable messages. The Tatar translation has been updated as well. --- ## Bug fixes ### Premium and proxy - Premium enrollment is finalized in-join on the v3/proxy path in offline-UUID mode, using the same one-shot gate as the login validator. No more double finalization or spurious "premium verification failed" messages. - Fixed premium cache handling on the proxy side - Premium names sent to the proxy are normalized - Pending state is held during premium verification, and a failed attempt now allows a reconnect so `/login` can be enforced - Auto-login carries through to whichever server the player joins next - Hardened `perform.login` handling during server transitions - A pending kick is applied after session or proxy auto-login verification, not before - Players no longer freeze after `/freemium` when proxy auto-login is active ([#3105](https://github.com/AuthMe/AuthMeReloaded/issues/3105)) - Ender pearls are restored for premium users - Premium profile creation no longer uses a deprecated API ### Dialogs - The pre-join login dialog is suppressed through config-phase auto-login when the player is already authenticated ([#3098](https://github.com/AuthMe/AuthMeReloaded/issues/3098)) - Players who cancel the login or registration dialog are kicked correctly when that option is enabled - The pre-join dialog is cancelled correctly on failure and on the cancel button - `maxRegPerIp` is now checked in the pre-join dialog workflow - The premium handshake is deferred if the first player to join cancels the dialog ### General - Walk and fly speed are restored correctly on quit, and corrupted speed values are repaired on join - Email verification codes are only registered once the email has actually been sent - Players are no longer teleported to 0,0,0 after a `resetpos` --- ## Breaking changes **PermissionsEx and zPermissions support has been removed.** Both have been unmaintained for years. Move to LuckPerms or another supported permissions plugin before updating. **`Hooks.proxySharedSecret` is now mandatory for proxy auto-login.** An empty value no longer falls back to an empty HMAC key. It rejects every `perform.login` message. --- ## Internal - JUnit 5 cleanup across the `output`, `permission`, `process`, `security`, `service`, `settings`, `task` and `util` packages ([#3106](https://github.com/AuthMe/AuthMeReloaded/issues/3106)) - Dependency updates --- ## Additional resources - [Configuration reference](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/config.md) - [Commands and permissions](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/commands.md) - [Hash algorithms](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/hash_algorithms.md) - [Converters](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/converters.md) - [Translations](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/translations.md) - [Premium bypass](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/premium.md) - [Proxy configuration](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/proxies/configuration.md)

# AuthMe 6.0.0 AuthMe 6.0.0 is a major overhaul focused on modern server compatibility, a cleaner authentication experience, and broader plugin ecosystem support. This is the first stable release of the 6.x line. ## Highlights ### Dedicated builds for every platform AuthMe now ships as separate, purpose-built jars for each server platform: **Spigot 1.16–1.19**, **Spigot 1.20–1.21+**, **Paper 1.21+** (1.21.11+ recommended for Dialog), and **Folia 1.21+**. Install the jar that matches your server — no further configuration needed to get the right behaviour for your platform. ### Native proxy plugins for BungeeCord and Velocity Two dedicated proxy plugins are now available, one for **BungeeCord** and one for **Velocity**. They handle authentication state synchronisation between the proxy and backend servers automatically, replacing the previous approach that relied solely on backend-side configuration. See the [proxy configuration guide](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/proxies/configuration.md) for setup instructions. ### Dialog-based login and registration On Spigot 1.21.6+ and Paper / Folia 1.21.11+, players are presented with a graphical dialog to log in or register — displayed right as they connect, before they even fully join the server. The dialog is shown in the player's own language. Several quality-of-life improvements ship with the dialog system: - **Email recovery in post-join dialogs** — players with a recovery email can trigger password recovery directly from the dialog - **"Let player in" recovery option** — a new setting allows players to partially join the server to complete account recovery rather than being held at the connection screen - **Customisable body description** — the body text of login/register dialogs is configurable per server - **Separate forgot-password dialog** — the forgot-password flow has its own dedicated UI for both pre-join and post-join contexts - **Register field validation** — pre-join registration dialogs validate fields (password length, email format, etc.) before submission - **Kick-on-cancel option** — a new setting controls whether players are kicked if they dismiss the pre-join dialog ### Premium bypass with cryptographic Mojang verification Players with a legitimate Mojang account can skip password authentication entirely. AuthMe verifies their identity via a full cryptographic handshake with Mojang's session server — no password prompt, no dialog box. This closes the spoofing vector that existed when relying solely on username matching. Three verification modes are supported automatically depending on your setup: direct offline-mode (requires PacketEvents), online-mode proxy (UUID forwarded by the proxy), and offline-mode proxy with the AuthMe proxy plugin. Premium player lists are synchronised automatically and sent in chunks for large servers. See the [premium bypass guide](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/premium.md) for full setup instructions. ### Messages in the player's own language AuthMe serves each player messages in their Minecraft client language, including login/register prompts, help output, and dialogs. When a player's locale is not available it falls back to the server's configured default. See the [translations reference](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/translations.md) for the full list of supported languages. New in this release: **Tatar** and **Spanish** translations. ### Eight new account importers The converter system now covers a wide range of authentication plugins. You can migrate accounts from: - **Auth+**, **LibreLogin**, **LimboAuth**, **nLogin** (including SQLite auto-detection), **OpeNLogin**, **tiAuth** All importers reuse the AuthMe connection pool and apply consistent UUID handling. See the [converters guide](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/converters.md) for usage. ### New `server` spawn priority A new `server` value is available for the spawn priority setting. The spawn location is determined by the configured server spawn point with an optional radius so players don't stack on the same block. Falls back to the default spawn location if none is available. ### Email confirmation on change `/email add` and `/email change` now require the player to confirm the new address before it is saved, preventing typos from locking players out of account recovery. ### Separate login and registration timeouts The single timeout setting has been split into two independent values: `loginTimeout` and `registerTimeout`. Existing configurations are migrated automatically — no action required. Full details are in the [configuration reference](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/config.md). ### New hash algorithm: PBKDF2BASE64 A new `PBKDF2BASE64` hash algorithm is now supported. See the [hash algorithms reference](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/hash_algorithms.md) for details. ### Ender pearls returned on login Ender pearls thrown before authentication are held and returned to the player's inventory on successful login rather than being lost. Configurable via `settings.restrictions.cancelThrownEnderPearlOnJoin`. --- ## Breaking changes **Java 17 is now the minimum required version for spigot-legacy.** Servers still running Java 8 or Java 11 must upgrade before installing this release. **Java 21 is now the minimum required version for other platforms (Spigot 1.21, Paper, Folia).** **PacketEvents** replaces ProtocolLib for inventory protection, tab-complete blocking, and premium bypass in direct-connection mode. Install [PacketEvents 2.x](https://modrinth.com/plugin/packetevents) if you use any of these features — ProtocolLib is no longer used for this purpose. --- ## Bug fixes - Quit location is now correctly saved on disconnect - Walk and fly speed are properly reset on auto-login via premium, session, or proxy - Admin force-login commands correctly dismiss any open dialog for the target player - Proxy auto-login works correctly when the target player is already online - Email format is validated before any processing is attempted - Email recovery UI is only shown when the email sending system is properly configured - TOTP QR codes are generated with a default margin - BungeeCord plugin messaging channel is correctly registered on startup - Brigadier command registration handles `@` characters and awaits proper type resolution - Converters correctly insert and update player UUIDs - Spawn location Y coordinate is correctly selected in `server` spawn mode --- ## Additional resources - [Configuration reference](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/config.md) - [Commands and permissions](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/commands.md) - [Permission nodes](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/permission_nodes.md) - [Hash algorithms](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/hash_algorithms.md) - [Converters](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/converters.md) - [Translations](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/translations.md) - [Premium bypass](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/premium.md) - [Proxy configuration](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/proxies/configuration.md)

# AuthMe 6.0.0 AuthMe 6.0.0 is a major overhaul focused on modern server compatibility, a cleaner authentication experience, and broader plugin ecosystem support. This is the first stable release of the 6.x line. ## Highlights ### Dedicated builds for every platform AuthMe now ships as separate, purpose-built jars for each server platform: **Spigot 1.16–1.19**, **Spigot 1.20–1.21+**, **Paper 1.21+** (1.21.11+ recommended for Dialog), and **Folia 1.21+**. Install the jar that matches your server — no further configuration needed to get the right behaviour for your platform. ### Native proxy plugins for BungeeCord and Velocity Two dedicated proxy plugins are now available, one for **BungeeCord** and one for **Velocity**. They handle authentication state synchronisation between the proxy and backend servers automatically, replacing the previous approach that relied solely on backend-side configuration. See the [proxy configuration guide](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/proxies/configuration.md) for setup instructions. ### Dialog-based login and registration On Spigot 1.21.6+ and Paper / Folia 1.21.11+, players are presented with a graphical dialog to log in or register — displayed right as they connect, before they even fully join the server. The dialog is shown in the player's own language. Several quality-of-life improvements ship with the dialog system: - **Email recovery in post-join dialogs** — players with a recovery email can trigger password recovery directly from the dialog - **"Let player in" recovery option** — a new setting allows players to partially join the server to complete account recovery rather than being held at the connection screen - **Customisable body description** — the body text of login/register dialogs is configurable per server - **Separate forgot-password dialog** — the forgot-password flow has its own dedicated UI for both pre-join and post-join contexts - **Register field validation** — pre-join registration dialogs validate fields (password length, email format, etc.) before submission - **Kick-on-cancel option** — a new setting controls whether players are kicked if they dismiss the pre-join dialog ### Premium bypass with cryptographic Mojang verification Players with a legitimate Mojang account can skip password authentication entirely. AuthMe verifies their identity via a full cryptographic handshake with Mojang's session server — no password prompt, no dialog box. This closes the spoofing vector that existed when relying solely on username matching. Three verification modes are supported automatically depending on your setup: direct offline-mode (requires PacketEvents), online-mode proxy (UUID forwarded by the proxy), and offline-mode proxy with the AuthMe proxy plugin. Premium player lists are synchronised automatically and sent in chunks for large servers. See the [premium bypass guide](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/premium.md) for full setup instructions. ### Messages in the player's own language AuthMe serves each player messages in their Minecraft client language, including login/register prompts, help output, and dialogs. When a player's locale is not available it falls back to the server's configured default. See the [translations reference](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/translations.md) for the full list of supported languages. New in this release: **Tatar** and **Spanish** translations. ### Eight new account importers The converter system now covers a wide range of authentication plugins. You can migrate accounts from: - **Auth+**, **LibreLogin**, **LimboAuth**, **nLogin** (including SQLite auto-detection), **OpeNLogin**, **tiAuth** All importers reuse the AuthMe connection pool and apply consistent UUID handling. See the [converters guide](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/converters.md) for usage. ### New `server` spawn priority A new `server` value is available for the spawn priority setting. The spawn location is determined by the configured server spawn point with an optional radius so players don't stack on the same block. Falls back to the default spawn location if none is available. ### Email confirmation on change `/email add` and `/email change` now require the player to confirm the new address before it is saved, preventing typos from locking players out of account recovery. ### Separate login and registration timeouts The single timeout setting has been split into two independent values: `loginTimeout` and `registerTimeout`. Existing configurations are migrated automatically — no action required. Full details are in the [configuration reference](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/config.md). ### New hash algorithm: PBKDF2BASE64 A new `PBKDF2BASE64` hash algorithm is now supported. See the [hash algorithms reference](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/hash_algorithms.md) for details. ### Ender pearls returned on login Ender pearls thrown before authentication are held and returned to the player's inventory on successful login rather than being lost. Configurable via `settings.restrictions.cancelThrownEnderPearlOnJoin`. --- ## Breaking changes **Java 17 is now the minimum required version for spigot-legacy.** Servers still running Java 8 or Java 11 must upgrade before installing this release. **Java 21 is now the minimum required version for other platforms (Spigot 1.21, Paper, Folia).** **PacketEvents** replaces ProtocolLib for inventory protection, tab-complete blocking, and premium bypass in direct-connection mode. Install [PacketEvents 2.x](https://modrinth.com/plugin/packetevents) if you use any of these features — ProtocolLib is no longer used for this purpose. --- ## Bug fixes - Quit location is now correctly saved on disconnect - Walk and fly speed are properly reset on auto-login via premium, session, or proxy - Admin force-login commands correctly dismiss any open dialog for the target player - Proxy auto-login works correctly when the target player is already online - Email format is validated before any processing is attempted - Email recovery UI is only shown when the email sending system is properly configured - TOTP QR codes are generated with a default margin - BungeeCord plugin messaging channel is correctly registered on startup - Brigadier command registration handles `@` characters and awaits proper type resolution - Converters correctly insert and update player UUIDs - Spawn location Y coordinate is correctly selected in `server` spawn mode --- ## Additional resources - [Configuration reference](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/config.md) - [Commands and permissions](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/commands.md) - [Permission nodes](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/permission_nodes.md) - [Hash algorithms](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/hash_algorithms.md) - [Converters](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/converters.md) - [Translations](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/translations.md) - [Premium bypass](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/premium.md) - [Proxy configuration](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/proxies/configuration.md)

# AuthMe 6.0.0 AuthMe 6.0.0 is a major overhaul focused on modern server compatibility, a cleaner authentication experience, and broader plugin ecosystem support. This is the first stable release of the 6.x line. ## Highlights ### Dedicated builds for every platform AuthMe now ships as separate, purpose-built jars for each server platform: **Spigot 1.16–1.19**, **Spigot 1.20–1.21+**, **Paper 1.21+** (1.21.11+ recommended for Dialog), and **Folia 1.21+**. Install the jar that matches your server — no further configuration needed to get the right behaviour for your platform. ### Native proxy plugins for BungeeCord and Velocity Two dedicated proxy plugins are now available, one for **BungeeCord** and one for **Velocity**. They handle authentication state synchronisation between the proxy and backend servers automatically, replacing the previous approach that relied solely on backend-side configuration. See the [proxy configuration guide](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/proxies/configuration.md) for setup instructions. ### Dialog-based login and registration On Spigot 1.21.6+ and Paper / Folia 1.21.11+, players are presented with a graphical dialog to log in or register — displayed right as they connect, before they even fully join the server. The dialog is shown in the player's own language. Several quality-of-life improvements ship with the dialog system: - **Email recovery in post-join dialogs** — players with a recovery email can trigger password recovery directly from the dialog - **"Let player in" recovery option** — a new setting allows players to partially join the server to complete account recovery rather than being held at the connection screen - **Customisable body description** — the body text of login/register dialogs is configurable per server - **Separate forgot-password dialog** — the forgot-password flow has its own dedicated UI for both pre-join and post-join contexts - **Register field validation** — pre-join registration dialogs validate fields (password length, email format, etc.) before submission - **Kick-on-cancel option** — a new setting controls whether players are kicked if they dismiss the pre-join dialog ### Premium bypass with cryptographic Mojang verification Players with a legitimate Mojang account can skip password authentication entirely. AuthMe verifies their identity via a full cryptographic handshake with Mojang's session server — no password prompt, no dialog box. This closes the spoofing vector that existed when relying solely on username matching. Three verification modes are supported automatically depending on your setup: direct offline-mode (requires PacketEvents), online-mode proxy (UUID forwarded by the proxy), and offline-mode proxy with the AuthMe proxy plugin. Premium player lists are synchronised automatically and sent in chunks for large servers. See the [premium bypass guide](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/premium.md) for full setup instructions. ### Messages in the player's own language AuthMe serves each player messages in their Minecraft client language, including login/register prompts, help output, and dialogs. When a player's locale is not available it falls back to the server's configured default. See the [translations reference](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/translations.md) for the full list of supported languages. New in this release: **Tatar** and **Spanish** translations. ### Eight new account importers The converter system now covers a wide range of authentication plugins. You can migrate accounts from: - **Auth+**, **LibreLogin**, **LimboAuth**, **nLogin** (including SQLite auto-detection), **OpeNLogin**, **tiAuth** All importers reuse the AuthMe connection pool and apply consistent UUID handling. See the [converters guide](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/converters.md) for usage. ### New `server` spawn priority A new `server` value is available for the spawn priority setting. The spawn location is determined by the configured server spawn point with an optional radius so players don't stack on the same block. Falls back to the default spawn location if none is available. ### Email confirmation on change `/email add` and `/email change` now require the player to confirm the new address before it is saved, preventing typos from locking players out of account recovery. ### Separate login and registration timeouts The single timeout setting has been split into two independent values: `loginTimeout` and `registerTimeout`. Existing configurations are migrated automatically — no action required. Full details are in the [configuration reference](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/config.md). ### New hash algorithm: PBKDF2BASE64 A new `PBKDF2BASE64` hash algorithm is now supported. See the [hash algorithms reference](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/hash_algorithms.md) for details. ### Ender pearls returned on login Ender pearls thrown before authentication are held and returned to the player's inventory on successful login rather than being lost. Configurable via `settings.restrictions.cancelThrownEnderPearlOnJoin`. --- ## Breaking changes **Java 17 is now the minimum required version for spigot-legacy.** Servers still running Java 8 or Java 11 must upgrade before installing this release. **Java 21 is now the minimum required version for other platforms (Spigot 1.21, Paper, Folia).** **PacketEvents** replaces ProtocolLib for inventory protection, tab-complete blocking, and premium bypass in direct-connection mode. Install [PacketEvents 2.x](https://modrinth.com/plugin/packetevents) if you use any of these features — ProtocolLib is no longer used for this purpose. --- ## Bug fixes - Quit location is now correctly saved on disconnect - Walk and fly speed are properly reset on auto-login via premium, session, or proxy - Admin force-login commands correctly dismiss any open dialog for the target player - Proxy auto-login works correctly when the target player is already online - Email format is validated before any processing is attempted - Email recovery UI is only shown when the email sending system is properly configured - TOTP QR codes are generated with a default margin - BungeeCord plugin messaging channel is correctly registered on startup - Brigadier command registration handles `@` characters and awaits proper type resolution - Converters correctly insert and update player UUIDs - Spawn location Y coordinate is correctly selected in `server` spawn mode --- ## Additional resources - [Configuration reference](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/config.md) - [Commands and permissions](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/commands.md) - [Permission nodes](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/permission_nodes.md) - [Hash algorithms](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/hash_algorithms.md) - [Converters](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/converters.md) - [Translations](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/translations.md) - [Premium bypass](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/premium.md) - [Proxy configuration](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/proxies/configuration.md)

# AuthMe 6.0.0 AuthMe 6.0.0 is a major overhaul focused on modern server compatibility, a cleaner authentication experience, and broader plugin ecosystem support. This is the first stable release of the 6.x line. ## Highlights ### Dedicated builds for every platform AuthMe now ships as separate, purpose-built jars for each server platform: **Spigot 1.16–1.19**, **Spigot 1.20–1.21+**, **Paper 1.21+** (1.21.11+ recommended for Dialog), and **Folia 1.21+**. Install the jar that matches your server — no further configuration needed to get the right behaviour for your platform. ### Native proxy plugins for BungeeCord and Velocity Two dedicated proxy plugins are now available, one for **BungeeCord** and one for **Velocity**. They handle authentication state synchronisation between the proxy and backend servers automatically, replacing the previous approach that relied solely on backend-side configuration. See the [proxy configuration guide](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/proxies/configuration.md) for setup instructions. ### Dialog-based login and registration On Spigot 1.21.6+ and Paper / Folia 1.21.11+, players are presented with a graphical dialog to log in or register — displayed right as they connect, before they even fully join the server. The dialog is shown in the player's own language. Several quality-of-life improvements ship with the dialog system: - **Email recovery in post-join dialogs** — players with a recovery email can trigger password recovery directly from the dialog - **"Let player in" recovery option** — a new setting allows players to partially join the server to complete account recovery rather than being held at the connection screen - **Customisable body description** — the body text of login/register dialogs is configurable per server - **Separate forgot-password dialog** — the forgot-password flow has its own dedicated UI for both pre-join and post-join contexts - **Register field validation** — pre-join registration dialogs validate fields (password length, email format, etc.) before submission - **Kick-on-cancel option** — a new setting controls whether players are kicked if they dismiss the pre-join dialog ### Premium bypass with cryptographic Mojang verification Players with a legitimate Mojang account can skip password authentication entirely. AuthMe verifies their identity via a full cryptographic handshake with Mojang's session server — no password prompt, no dialog box. This closes the spoofing vector that existed when relying solely on username matching. Three verification modes are supported automatically depending on your setup: direct offline-mode (requires PacketEvents), online-mode proxy (UUID forwarded by the proxy), and offline-mode proxy with the AuthMe proxy plugin. Premium player lists are synchronised automatically and sent in chunks for large servers. See the [premium bypass guide](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/premium.md) for full setup instructions. ### Messages in the player's own language AuthMe serves each player messages in their Minecraft client language, including login/register prompts, help output, and dialogs. When a player's locale is not available it falls back to the server's configured default. See the [translations reference](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/translations.md) for the full list of supported languages. New in this release: **Tatar** and **Spanish** translations. ### Eight new account importers The converter system now covers a wide range of authentication plugins. You can migrate accounts from: - **Auth+**, **LibreLogin**, **LimboAuth**, **nLogin** (including SQLite auto-detection), **OpeNLogin**, **tiAuth** All importers reuse the AuthMe connection pool and apply consistent UUID handling. See the [converters guide](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/converters.md) for usage. ### New `server` spawn priority A new `server` value is available for the spawn priority setting. The spawn location is determined by the configured server spawn point with an optional radius so players don't stack on the same block. Falls back to the default spawn location if none is available. ### Email confirmation on change `/email add` and `/email change` now require the player to confirm the new address before it is saved, preventing typos from locking players out of account recovery. ### Separate login and registration timeouts The single timeout setting has been split into two independent values: `loginTimeout` and `registerTimeout`. Existing configurations are migrated automatically — no action required. Full details are in the [configuration reference](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/config.md). ### New hash algorithm: PBKDF2BASE64 A new `PBKDF2BASE64` hash algorithm is now supported. See the [hash algorithms reference](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/hash_algorithms.md) for details. ### Ender pearls returned on login Ender pearls thrown before authentication are held and returned to the player's inventory on successful login rather than being lost. Configurable via `settings.restrictions.cancelThrownEnderPearlOnJoin`. --- ## Breaking changes **Java 17 is now the minimum required version for spigot-legacy.** Servers still running Java 8 or Java 11 must upgrade before installing this release. **Java 21 is now the minimum required version for other platforms (Spigot 1.21, Paper, Folia).** **PacketEvents** replaces ProtocolLib for inventory protection, tab-complete blocking, and premium bypass in direct-connection mode. Install [PacketEvents 2.x](https://modrinth.com/plugin/packetevents) if you use any of these features — ProtocolLib is no longer used for this purpose. --- ## Bug fixes - Quit location is now correctly saved on disconnect - Walk and fly speed are properly reset on auto-login via premium, session, or proxy - Admin force-login commands correctly dismiss any open dialog for the target player - Proxy auto-login works correctly when the target player is already online - Email format is validated before any processing is attempted - Email recovery UI is only shown when the email sending system is properly configured - TOTP QR codes are generated with a default margin - BungeeCord plugin messaging channel is correctly registered on startup - Brigadier command registration handles `@` characters and awaits proper type resolution - Converters correctly insert and update player UUIDs - Spawn location Y coordinate is correctly selected in `server` spawn mode --- ## Additional resources - [Configuration reference](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/config.md) - [Commands and permissions](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/commands.md) - [Permission nodes](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/permission_nodes.md) - [Hash algorithms](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/hash_algorithms.md) - [Converters](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/converters.md) - [Translations](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/translations.md) - [Premium bypass](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/premium.md) - [Proxy configuration](https://github.com/AuthMe/AuthMeReloaded/tree/master/docs/proxies/configuration.md)