PT-2026-80652

Summary The fix for GHSA-v2wp-frmc-5q3v added validate acme url to reject acme url values not in ACME DIRECTORY HOST ALLOWLIST, but the validation is only called at authority creation time POST. The authority update endpoint PUT /api/1/authorities/ accepts and stores arbitrary options -- includin...