This release includes 3 security fixes for security teams reviewing exposed deployments.
Topics
+1 more
Affected surfaces
ReleasePort's take
Moderate signalRelease v0.25.10 of One Time Secret introduces critical MFA hardening and several bug fixes across authentication, logging, and build tooling.
Why it matters: MFA hardening improvements in version v0.25.10 (severity 90) protect multi‑factor authentication flows; all deployments should upgrade to this release immediately.
Summary
AI summaryUpdates Deployment notes, Fix, and main across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
MFA hardening improvements for v0.25.10. MFA hardening improvements for v0.25.10. Source: llm_adapter@2026-06-15 Confidence: high |
— |
| Feature | Low |
Add one‑click SSO to disabled homepage and refactor SSO form submission. Add one‑click SSO to disabled homepage and refactor SSO form submission. Source: llm_adapter@2026-06-15 Confidence: high |
— |
| Feature | Low |
Add IP‑privacy trusted‑proxy reproduction script. Add IP‑privacy trusted‑proxy reproduction script. Source: llm_adapter@2026-06-15 Confidence: high |
— |
| Feature | Low |
Add env var DEFAULT_DISABLED_HOMEPAGE_VARIANT to control homepage variant when disabled. Add env var DEFAULT_DISABLED_HOMEPAGE_VARIANT to control homepage variant when disabled. Source: granite4.1:30b@2026-06-15-audit Confidence: low |
— |
| Dependency | Low |
Update dependency esbuild to ^0.28.0 (security update). Update dependency esbuild to ^0.28.0 (security update). Source: llm_adapter@2026-06-15 Confidence: low |
— |
| Bugfix | Medium |
Fix MFA QR code to encode correct HMAC secret. Fix MFA QR code to encode correct HMAC secret. Source: llm_adapter@2026-06-15 Confidence: high |
— |
| Bugfix | Medium |
Use SecureRandom for all randomness in generated‑secret password generation. Use SecureRandom for all randomness in generated‑secret password generation. Source: llm_adapter@2026-06-15 Confidence: high |
— |
| Bugfix | Medium |
Honour `continue=false` on burn endpoints (v1 and v2). Honour `continue=false` on burn endpoints (v1 and v2). Source: llm_adapter@2026-06-15 Confidence: high |
— |
| Bugfix | Medium |
Log the real secret identifier on receipt reveal/burn transitions instead of empty string. Log the real secret identifier on receipt reveal/burn transitions instead of empty string. Source: llm_adapter@2026-06-15 Confidence: high |
— |
| Bugfix | Medium |
Fix colonel preview plan mode to reflect the selected plan. Fix colonel preview plan mode to reflect the selected plan. Source: llm_adapter@2026-06-15 Confidence: high |
— |
| Bugfix | Medium |
Give IP privacy middleware a trusted‑proxy configuration. Give IP privacy middleware a trusted‑proxy configuration. Source: llm_adapter@2026-06-15 Confidence: high |
— |
| Refactor | Medium |
Normalize numeric fields to strings in Onetime::Secret model before saving. Normalize numeric fields to strings in Onetime::Secret model before saving. Source: granite4.1:30b@2026-06-15-audit Confidence: low |
— |
| Refactor | Low |
Use merge semantics for disabled_homepage_variant and drop UNCHANGED_VARIANT sentinel. Use merge semantics for disabled_homepage_variant and drop UNCHANGED_VARIANT sentinel. Source: granite4.1:30b@2026-06-15-audit Confidence: low |
— |
Full changelog
Deployment notes
Secret no longer available
Includes an interim fix for #3424, which is preventing good, kind secrets from being received properly. It is backwards compatible and safe for for healthy records since it only normalizes the wire format. There should be no behaviour change for unaffected secrets. In a nutshell: something is changing specific numeric fields in the Onetime::Secret model to strings prior to saving. Long-term, numeric coercion should move to write/load time in the model layer so we can handle this kind of behaviour in a robust manner.
Disabled Homepage
A change in v0.25.8 changed the layout for the homepage when Homepage Secrets is disabled (the default state), that included a prominent Sign-Button (variant=minimal). This release reverts that so the homepage defaults to the quiet "members only" page again (variant=closed). If you have a preference for one or the other, there is a new env var: e.g. DEFAULT_DISABLED_HOMEPAGE_VARIANT=minimal.
What's Changed
- Add IP-privacy trusted-proxy reproduction script (#3427) https://github.com/onetimesecret/onetimesecret/pull/3435
- Add one-click SSO to disabled homepage and refactor SSO form submission* https://github.com/onetimesecret/onetimesecret/pull/3433
- Cast numeric fields to numbers at safe_dump boundary (#3424) * https://github.com/onetimesecret/onetimesecret/pull/3434
- Use merge semantics for disabled_homepage_variant; drop UNCHANGED_VARIANT sentinel https://github.com/onetimesecret/onetimesecret/pull/3440
Fixes
- Fix MFA QR code to encode correct HMAC secret (issue #3431) https://github.com/onetimesecret/onetimesecret/pull/3437
- Fix colonel preview plan mode not reflecting the selected plan https://github.com/onetimesecret/onetimesecret/pull/3457
- Fix/changelog catsup https://github.com/onetimesecret/onetimesecret/pull/3447
- Fix: give the IP privacy middleware a trusted-proxy config by @syphernl in https://github.com/onetimesecret/onetimesecret/pull/3429
- MFA hardening for v0.25.10 (cherry-pick of #3455 onto main) https://github.com/onetimesecret/onetimesecret/pull/3459
- Use SecureRandom for all randomness in generated-secret password generation (main) https://github.com/onetimesecret/onetimesecret/pull/3458
- Honour continue=false on burn endpoints (v1 and v2) https://github.com/onetimesecret/onetimesecret/pull/3450
- Log the real secret identifier on receipt reveal/burn transitions instead of "" https://github.com/onetimesecret/onetimesecret/pull/3451
Dependencies
- Update dependency esbuild to ^0.28.0 [SECURITY] by @renovate[bot] in https://github.com/onetimesecret/onetimesecret/pull/3442
Full Changelog: https://github.com/onetimesecret/onetimesecret/compare/v0.25.9...v0.25.10
Security Fixes
- MFA hardening (cherry‑pick of #3455) – improves authentication security in v0.25.10
- Use SecureRandom for all randomness in generated‑secret password generation
- Dependency update: esbuild ^0.28.0 [SECURITY]
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About One Time Secret
Share sensitive information securely with self-destructing links that are only viewable once.
Related context
Related tools
Earlier breaking changes
- v0.25.5-coda Removes `site.interface.ui.homepage.trusted_ip_header` config; replaces with `site.network.trusted_proxy.header` settings.
- v0.25.5-coda Removes `site.interface.ui.homepage.trusted_proxy_depth` config; replaces with `site.network.trusted_proxy` settings.
Beta — feedback welcome: [email protected]