Security update: Docker images from v0.4.0-rc.1 fix the high-severity FFmpeg MagicYUV decoder vulnerability (CVE-2026-8461). Upgrade instances using older images immediately.View CVE advisory

Security update: v0.4.0-beta.3 fixes a WebDAV request issue that can terminate the server process. Upgrade older instances promptly.View advisory

Authentication and Cookies

Entry point: Admin -> System Settings -> Authentication and Cookies. For other groups and when changes take effect, see System Settings.

This group decides browser login behavior and session safety.

Authentication Cookie Sent Only Over HTTPS - Keep enabled in production. Disable temporarily only for local or intranet plain-HTTP trial runs.
Access Token TTL, Refresh Token TTL - Control how long login state is maintained.
Registration Activation Link TTL
Email Address Change Link TTL
Password Reset Link TTL
Verification Email Resend Cooldown
Password Reset Request Cooldown
Require Email Code MFA - Requires working mail delivery. After enabling it, verified-email users without TOTP can complete second-factor verification with an 8-digit email code after password or external identity login.
Allow TOTP Email Fallback - Allows users who already have an authenticator to choose email code on the MFA login page. Security-sensitive sites can keep it disabled.
Email Login Code TTL - Default is 10 minutes; actual validity never exceeds the remaining lifetime of the current MFA login flow.
Email Login Code Resend Cooldown - Default is 60 seconds.

For normal deployments, you usually only need to confirm cookie security requirements and link TTLs match your site policy.