Package: python3-id
Version: 1.5.0-1
Dist: trixie
Severity: important
Tags: security upstream
The provided package revision (1.5.0-1) lacks strictly required
audience validation. The revision 1.6.1-1 provided in forky and
sid provides the correct validation mechanisms.
Forensic reference:
Upstream resolved this critical token-substitution vulnerability
via Commit 90fa386 ("Audience fixes") on February 3, 2026. Please
consider a fast-track backport to trixie-stable to preserve OIDC
protocol integrity.
Regards,
Timo Gerke
