Duplicati will only accept localhost as the hostname by default. If you are using another hostname, you need to enable it with — webservice-allowedhostnames=hostname. Use the hostname * to disable the security mechanism.
It is not a new thing though, it should have been like this for several years?