v1.5.7-stable
datalab-to/suryav1.5.7-stableOct 4, 2026by gtsteffaniak
Upgrading?
AI Summary
Supersedes v1.5.6 with a high-severity security fix for TOTP re-enrollment that allows anonymous callers to bypass authentication.
Key Highlights
- High severity security fix for TOTP re-enrollment (GHSA-qx86-4v5r-26g5).
- Requires authenticated session for TOTP reset/replacement.
Full Release Notes
## What's Changed > [!WARNING] > This release has been superseded by v1.5.8-stable, as it introudces a TOTP login change that prevented login in some circumstances. **Security**: - [High] TOTP re-enrollment via `POST /api/auth/otp/generate` and `POST /api/auth/otp/verify` no longer allows anonymous callers to replace an existing second factor using only the account password; reset or replace requires an authenticated self or admin session (first-time enrollment without MFA unchanged) (GHSA-qx86-4v5r-26g5) -- thanks @tao0845. **Notes**: - [docker] upgraded ffmpeg version from 9.0.1 to 9.0.2 ## All Changes * updated dependencies v1.5.7-stable by @gtsteffaniak in https://github.com/gtsteffaniak/filebrowser/pull/3066 * Fix TOTP re-enrollment MFA bypass (GHSA-qx86-4v5r-26g5). by @gtsteffaniak in https://github.com/gtsteffaniak/filebrowser/pull/3068 * updated docker ffmpeg v1.5.7 by @gtsteffaniak in https://github.com/gtsteffaniak/filebrowser/pull/3069 **Full Changelog**: https://github.com/gtsteffaniak/filebrowser/compare/v1.5.6-stable...v1.5.7-stable
Related Repositories
public-apis/public-apis★ 491,314
A collective list of free APIs
NousResearch/hermes-agent★ 256,162
The agent that grows with you
yt-dlp/yt-dlp★ 200,366
A feature-rich command-line audio/video downloader
microsoft/markitdown★ 191,619
Python tool for converting files and office documents to Markdown.
Significant-Gravitas/AutoGPT★ 187,709
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.