The Market SSO flow has been significantly improved to increase security. A new UUID is generated as the nonce for every SSO session instead of using a value created at server startup. The nonce and callbackUri are stored in temporary cookies with a five-minute lifetime. During the callback process, both values must match the stored cookies before authentication is accepted. Temporary SSO cookies are automatically removed after the callback completes, and stricter callbackUri validation blocks absolute URLs, //, and /\ patterns to reduce the risk of open redirect attacks.

Introduced AutoPassUriTemplateManager in the common SDK and AdminAutoPassUriTemplateManager for the Admin module. AdminAuthenticationInterceptor can now bypass authentication for URI templates registered at runtime, in addition to public URIs and the admin_auto_pass_management_uris configuration. This makes it easier for plugins and modules to expose special endpoints without modifying static configuration files.

The Admin login page now supports additional extension points, including additionalHeads, additionalStyleFiles, additionalStyles, additionalScripts, additionalFoots, finalScriptFiles, pageFragments, and several new placeholders. The Super Admin setup page has been enhanced with the same extension capabilities, allowing plugins and themes to inject or replace content without modifying the original templates. JavaScript functions on the setup page have also been consolidated under the ezyadmin namespace to reduce the risk of global naming conflicts.

Added new wrappers and placeholders around email and phone fields, including adminEmailValueAfter, adminPhoneValueAfter, userEmailValueAfter, and userPhoneValueAfter. These extension points allow plugins to display verification badges, action buttons, status indicators, or other custom components next to contact information. Role tables on both Admin and User profile pages have also been updated to use the full available width for better readability.

Added support for retrieving a user's phone number by user ID through UserService#getPhoneByUserId(long userId), DefaultUserService#getPhoneByUserId, and UserRepository#findPhoneByUserId. A new PhoneResult query model has also been introduced to support this functionality.

Introduced CollectionFunctions.normalizeList(List<String>) to simplify processing of string collections. The utility automatically returns an empty list when the input is null, removes null, empty, and whitespace-only entries, and trims all remaining string values.

Removed the game-box dependency from ezyplatform-socket-sdk and removed the game.box.version property from ezyplatform-parent, resulting in a cleaner dependency structure and simpler project maintenance.