WS-2026-0083

OpenBao before 2.6.3 / 2.7.0-beta: the PKI secrets engine's ACME order finalization only checked the DNS and IP identifiers in the submitted CSR against the order's validated identifiers, so other Subject Alternative Names such as email, URI or other SAN types were issued in the certificate witho...