Yuvomi

Security

• A housekeeping staff account can no longer be signed in through SSO (GHSA-4jcg-7jvj-p4v9). Staff accounts have been refused at the password sign-in since v0.63.0, but the rule lived only in that route. The OIDC callback found the same account through an identity already linked to it, or linked it through a provider-verified email matching the account’s contact email, and opened a full session - with the second factor enabled, by way of the code prompt. The rule now sits in one place that every sign-in path asks: the callback checks it before linking, before the second factor and before the session, a staff account is never linked by email, and the session setup itself refuses such an account as a last line. Only installations with OIDC configured were affected; password sign-in and members signing in through SSO behave as before.