ВЕРСИИ (3)

> **⚠️ This update is required.** Version 1.0.1 and below contain a critical login bypass that lets an attacker join a registered account without its password. If your server uses premium mode, update now — leaving an older version running puts every account on your server at risk. Hello everyone! Login+ **1.0.2** fixes that critical login bug, adds Velocity support and makes the plugin easier to set up. ### Security - **Fixed a critical authentication flaw in premium mode.** Under certain conditions a registered account could be joined without entering its password. Updating is a drop-in — no config or database changes are required, so there is no reason to stay on an old version. ### Added - **Velocity support.** Login+ now runs on the proxy as well, so players authenticate once at the entrance and stay logged in on every backend server. The plugin must be installed **on the proxy and on every backend server** behind it. - **Login MOTD.** A welcome message of your own is sent the moment a player is authenticated. - **Login titles.** A title and subtitle appear on screen after a successful login — text, colors and timings are all yours to set. ### Changed - **Simpler customisation.** The new MOTD and titles are edited in one place in plain text with the usual color codes, and can be disabled completely. - **Cleaner config layout.** Options are grouped by feature and much easier to find. Your existing `config.yml` is upgraded automatically on first start and all of your own values are kept. --- Updating from **1.0.1** is a drop-in: just replace the jar. The database and config upgrade themselves, and customized message files keep working.

--- Hello everyone, today Login+ gets its first update — four new features and a big round of security hardening, fully translated into English and Russian! - Added one-time 2FA backup codes: enabling 2FA now gives you 8 single-use codes like XXXX-XXXX that log you in if you ever lose your authenticator, Discord or Telegram — check how many are left with /2fa status, generate a fresh set with /2fa backup <password>, and the account owner gets a security alert whenever one is used; only hashes are stored, so the codes can never be read back, not even by the server owner - Added account migration from other auth plugins through /loginplus import <authme|nlogin> [file], which imports names, registration dates, IPs and recovery e-mails from the AuthMe or nLogin database (SQLite); old password hashes keep working and are upgraded to Argon2id automatically at each player's first login, so players notice nothing at all - Added forced 2FA for staff: anyone with the new permission loginplus.require2fa (or every operator, with the new config option two-factor.require-for-staff.ops) is frozen after logging in until they finish /2fa setup — skipped automatically while no 2FA method is enabled, so a config mistake can never lock your team out - Added Telegram one-tap login approval — login requests now arrive with ✅ It's me / ❌ Not me buttons, one tap logs you in or kicks the attacker, and typing the 6-digit code still works as a fallback (new config option two-factor.telegram.one-tap-approve, on by default) - Improved the /loginplus help, which now lists one command per line with a short description instead of cramming everything into a single line, matching the /2fa and /email style - Fixed password checks in /changepassword, /unregister, /2fa disable and /email remove having no attempt limit, which let a stolen session brute-force the account password unnoticed and spam the server with heavy hash computations; three wrong passwords now lock these commands for a while and warn the account owner via Discord/Telegram - Fixed e-mail recovery codes being guessable by command spam — three wrong tries now invalidate the code and end the connection - Fixed the e-mail cooldown resetting when a player rejoins, which could be abused to flood someone's inbox with recovery mails; the cooldown is now tied to the account and survives relogging - Fixed /2fa resend having no cooldown, which allowed flooding a player's DMs with login codes — requesting a new code now has a 30-second cooldown - Fixed 2FA setup confirmation codes never expiring and accepting unlimited guesses; they now expire after 10 minutes and are dropped after three wrong attempts, and e-mail confirmation codes got the same three-attempt limit - Fixed e-mail recovery codes being guessable by command spam — three wrong tries now invalidate the code and end the connection - Fixed the e-mail cooldown resetting when a player rejoins, which could be abused to flood someone's inbox with recovery mails; the cooldown is now tied to the account and survives relogging - Fixed /2fa resend having no cooldown, which allowed flooding a player's DMs with login codes — requesting a new code now has a 30-second cooldown - Fixed 2FA setup confirmation codes never expiring and accepting unlimited guesses; they now expire after 10 minutes and are dropped after three wrong attempts, and e-mail confirmation codes got the same three-attempt limit Updating from 1.0.0 is a drop-in: just replace the jar — the database and config upgrade themselves, and customized message files keep working.

Write the bugs here: https://discord.gg/BRVmQVNPQQ Support me: https://buymeacoffee.com/criticai