Greetings!
I recently had a hacker on my server somehow bypass UUID auth, can we have a toggle feature to remove all permissions if the UUID doesnt match with the original UUID the user used to log in?

Is this cracked server? (offline mode)

I mean it's your own fault/risk when the server is in offline/cracked mode.
Because there is virtually no real method to fake a UUID with a cracked account on a online server, since the account will be checked on login, if the UUID is a legit one (and probs even if the name is the same)

get a better Auth plugin, or code one yourself (thats what I did for mine ;p)

Is this cracked server? (offline mode)

obv he does

do they realize thats what can happen in offline mode?

As I mentioned in Discord, I think this would be better handled by an authentication / 2fa plugin.

Thanks for the suggestion, but on this occasion I don't think it's something I'd like to add to the plugin.