One-Time Passcode Integration Kit changelog

The following is the change history for the One-Time Passcode Integration Kit.

Version 1.2 (November 2026)

Upgraded the Twilio SDK to 13.0.0 in the Twilio Programmable API and Verify API notification publishers.
Removed the Connection Timeout field for Twilio notification publishers. Connection establishment now uses the value configured for API Request Timeout. Learn more in Twilio Programmable API settings reference and Twilio Verify API settings reference.
Added customizable masking of target addresses per delivery method. This allows you to override the default masking rules using the Visible Leading Characters and Visible Trailing Characters fields. Learn more in Configuring an adapter instance.

Fixed an issue with authentication handling. Learn more in security bulletin SECADV053 (requires sign-on).

Fixed an issue with authentication handling. Learn more in security bulletin SECADV051 (requires sign-on).

Added a default masking mechanism for arbitrary emails and phone number formats that fail the built-in validation.

Learn more in the Visible Leading Characters Length and Visible Trailing Characters Length table entries in the One-Time Passcode IdP Adapter settings reference.
Added the ability to customize velocity templates for specific adapter instances.

Learn more in the HTML Template Prefix table entry in the One-Time Passcode IdP Adapter settings reference.
Added the ability to pass dynamic user information to velocity templates.

Learn more in step 5 of the Configuring an adapter instance procedure.
Added the ability to use a Messaging Service SID with the Twilio Programmable API Notification Publisher.

Learn more in the Messaging Service SID table entry in the Twilio Programmable API Notification Publisher settings reference.
Upgraded the Twilio SDK jar used in the Twilio Programmable API Notification Publisher and the Twilio Verify API Notification Publisher.

Fixed an issue that prevented the One-Time Passcode IdP Adapter from creating LDAPS datastore connections.
Fixed an issue with an invalid URL in the adapter CSS.
Upgraded the Apache Commons Text library to version 1.10.0 to follow best practices for CVE-2022-42889.

The One-Time Passcode IdP Adapter was not vulnerable to this issue.

Fixed an issue that caused an error when a PingFederate node loaded the adapter while a user was authenticating.

Initial release.
Added the ability to use the adapter with a UI or through the PingFederate authentication API.
Added the ability to look up user device details in a data store attached to PingFederate.
Added the ability to use chained attributes from earlier in the authentication flow.
Added the ability to allow users to choose their delivery method.
Added the ability to stop or continue authentication when the data store lookup fails.
Added the ability to send one-time passcodes through PingFederate notification publishers.
Added the Twilio Verify API Notification Publisher.
Added the Twilio Programmable API Notification Publisher.