AuthMe 6.0.1

A maintenance release for the 6.x line. It closes several session-handling holes in the Paper and Folia builds, hardens the proxy and premium bypass paths, and adds a new hash algorithm, a new converter and a new API method.

If you run the Paper or Folia jar with pre-join dialogs enabled, update as soon as you can. See the security section below.

Full changelog: <tt>6.0.0...6.0.1</tt>

Security fixes

Pre-join session takeover on Paper and Folia

This affects the Paper 1.21+ and Folia 1.21+ builds on offline-mode servers, when the pre-join login/registration dialog is in use.

The transient state of a pre-join dialog (the password being typed, the registration data, the recovery email, the pending kick message, the force-login future) was stored under the player's UUID. On an offline-mode server, every connection using the same name resolves to the same offline UUID. That meant a second connection opened on a registered player's name shared the state of the connection that was still authenticating, and could read it or wipe it.

Three changes fix this:

• Pre-join state is now keyed by connection session instead of by player name or profile id. Opening a session for a new connection discards the state of any earlier session for that name, so it can never be inherited, and the state is consumed in one go so nothing is left half-read. (39eed4e)
• A connection now claims the player name while it is still being established, before the play state. The new PendingConnectionRegistry holds the name for the login or registration timeout plus a short grace period. A second connection on the same name gets the "already online" message instead of racing the first one. The single-session check also runs again during the configuration phase, not only during login. Claims expire on a TTL and are released on join or on disconnect, so a name can never stay locked out. (098ef5e)
• A pre-join connection whose name claim was taken over is now denied instead of being allowed to continue. (8b41f72)

Proxy auto-login with an unset shared secret

Leaving Hooks.proxySharedSecret empty on a backend used to run HMAC verification anyway, with the empty string as the key. That offered no real protection against forged perform.login messages. An empty secret now rejects every perform.login message and logs Hooks.proxySharedSecret is not configured. (5722849)

If you rely on proxy auto-login, copy the proxy-generated secret to every backend before updating. See proxy configuration.

Premium claims accepted while premium was disabled

The proxy login validator had no enablePremium gate. A proxy-verified premium claim for a player whose database row still carried a premiumUuid was accepted even after the feature had been turned off on the backend. On top of that, the proxy.started handler skipped sending the premium list when it was empty, so the proxy kept a stale premium_names.cache and went on verifying enrolled players.

Both paths are now gated on the setting, and an empty list is sent as authoritative so the proxy replaces and persists its cache on first contact instead of waiting for a restart. (0f148bf, 5bae6ee, #3127)

New features

ARGON2ID hash algorithm

ARGON2ID is now available as a recommended passwordHash value. The recent hash implementations have also moved to BouncyCastle. See the hash algorithms reference.

NexAuth converter

You can now migrate accounts from NexAuth with /authme converter nexauth. The converter reads plugins/NexAuth/config.conf to work out the storage backend. SQLite is read directly, so no shared database is needed, and MySQL and PostgreSQL are supported too. Premium UUIDs and TOTP secrets are preserved, and players already present in AuthMe are skipped. See the converters guide.

Note that the LibreLogin converter now maps Argon2-ID to ARGON2ID rather than ARGON2.

premium.keepOfflineUuidCompatibility on the proxy plugins

A new proxy-side flag controls how premium players appear to backend servers. With the default false, premium players keep their Mojang UUID v4. With true, they keep the backend offline UUID v3 for plugin compatibility. Velocity handles both modes natively. On BungeeCord, PacketEvents is only needed when the flag is true.

AuthMeApi#forceLoginFromProxy(String)

A new API method that lets proxy plugins force a login before the Player object exists, which bypasses the Paper/Folia pre-join dialog. Queue-first ordering keeps it race-safe against AsynchronousJoin. Completion is asynchronous, and the caller is responsible for authenticating the proxy signal. (#3118)

Cancellation messages

Dialog cancellation now has its own translatable messages. The Tatar translation has been updated as well.

Bug fixes

Premium and proxy

• Premium enrollment is finalized in-join on the v3/proxy path in offline-UUID mode, using the same one-shot gate as the login validator. No more double finalization or spurious "premium verification failed" messages.
• Fixed premium cache handling on the proxy side
• Premium names sent to the proxy are normalized
• Pending state is held during premium verification, and a failed attempt now allows a reconnect so /login can be enforced
• Auto-login carries through to whichever server the player joins next
• Hardened perform.login handling during server transitions
• A pending kick is applied after session or proxy auto-login verification, not before
• Players no longer freeze after /freemium when proxy auto-login is active (#3105)
• Ender pearls are restored for premium users
• Premium profile creation no longer uses a deprecated API

Dialogs

• The pre-join login dialog is suppressed through config-phase auto-login when the player is already authenticated (#3098)
• Players who cancel the login or registration dialog are kicked correctly when that option is enabled
• The pre-join dialog is cancelled correctly on failure and on the cancel button
• maxRegPerIp is now checked in the pre-join dialog workflow
• The premium handshake is deferred if the first player to join cancels the dialog

General

• Walk and fly speed are restored correctly on quit, and corrupted speed values are repaired on join
• Email verification codes are only registered once the email has actually been sent
• Players are no longer teleported to 0,0,0 after a resetpos

Breaking changes

PermissionsEx and zPermissions support has been removed. Both have been unmaintained for years. Move to LuckPerms or another supported permissions plugin before updating.

Hooks.proxySharedSecret is now mandatory for proxy auto-login. An empty value no longer falls back to an empty HMAC key. It rejects every perform.login message.

Internal

• JUnit 5 cleanup across the output, permission, process, security, service, settings, task and util packages (#3106)
• Dependency updates

Additional resources

• Configuration reference
• Commands and permissions
• Hash algorithms
• Converters
• Translations
• Premium bypass
• Proxy configuration