kanidm_client (>=1.1.0-alpha.3, <=1.1.0-alpha.7), kanidm_tools (>=1.1.0-alpha.3, <=1.1.0-alpha.8) potentially affected by unknown CVE via webauthn-authenticator-rs (0.3.2)

webauthn-authenticator-rs CARGO version 0.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on webauthn-authenticator-rs and may be impacted: - kanidmclient =1.1.0-alpha.3, =1.1.0-alpha.3, =1.1.0-alpha.8 Source cves: unknown CVE Source advisory:...

PT-2026-39163

Summary webauthn-rs-core Relying Partyrp and webauthn-authenticator-rs client checked that an Origin in CollectedClientDataorigin is valid for an RP IDrpid with str::ends withends-with, without checking for a dot . before the RP ID when allowing subdomainsregisterable-suffix. This check is flawed...