Comment by sebdufbeau

there's another one this summer that didn't get as much attention (or any at all) which allowed exfiltrating master provider keys with any authenticated user/virtual key

https://nvd.nist.gov/vuln/detail/cve-2026-84377