One-Time Passcode Integration Kit changelog

The following is the change history for the One-Time Passcode Integration Kit.

Version 1.1.3

Released in March 2026.

Fixed an issue with authentication handling. Learn more in an upcoming security bulletin, SECADV053.

Released in January 2026.

Released in October 2025.

Fixed an issue with authentication handling. Learn more in security bulletin SECADV051 (requires sign-on).

Released in April 2025.

Added a default masking mechanism for arbitrary emails and phone number formats that fail the built-in validation.

Learn more in the Visible Leading Characters Length and Visible Trailing Characters Length table entries in the One-Time Passcode IdP Adapter settings reference.
Added the ability to customize velocity templates for specific adapter instances.

Learn more in the HTML Template Prefix table entry in the One-Time Passcode IdP Adapter settings reference.
Added the ability to pass dynamic user information to velocity templates.

Learn more in step 5 of the Configuring an adapter instance procedure.
Added the ability to use a Messaging Service SID with the Twilio Programmable API Notification Publisher.

Learn more in the Messaging Service SID table entry in the Twilio Programmable API Notification Publisher settings reference.
Upgraded the Twilio SDK jar used in the Twilio Programmable API Notification Publisher and the Twilio Verify API Notification Publisher.

Released in August 2023.

Fixed an issue that prevented the One-Time Passcode IdP Adapter from creating LDAPS datastore connections.
Fixed an issue with an invalid URL in the adapter CSS.
Upgraded the Apache Commons Text library to version 1.10.0 to follow best practices for CVE-2022-42889.

The One-Time Passcode IdP Adapter was not vulnerable to this issue.

Released in June 2021.

Fixed an issue that caused an error when a PingFederate node loaded the adapter while a user was authenticating.

Released in June 2020.

Initial release.
Added the ability to use the adapter with a UI or through the PingFederate authentication API.
Added the ability to look up user device details in a data store attached to PingFederate.
Added the ability to use chained attributes from earlier in the authentication flow.
Added the ability to allow users to choose their delivery method.
Added the ability to stop or continue authentication when the data store lookup fails.
Added the ability to send one-time passcodes through PingFederate notification publishers.
Added the Twilio Verify API Notification Publisher.
Added the Twilio Programmable API Notification Publisher.