AuthMe ForceLogin

Bug Fix: We have resolved a security vulnerability where players could exploit the system if the plugin detected 127.0.0.1 or a local IP address.

Previously, a local IP detection could allow the automatic login bypass to trigger incorrectly. This has been fixed: the bypass mechanism is now strictly disabled for 127.0.0.1 and all local loopback addresses to ensure player authentication cannot be spoofed.

Security Warning: If running behind a proxy (Velocity/BungeeCord), you must configure IP forwarding properly. If the plugin detects 127.0.0.1 as the player's IP, automatic login will now fail completely for that player rather than risking a security bypass for all local connections.