Security fixes
GHSA-vvpj-p7j8-4rv4 - A compromised OIDC provider can inject HTML into the redirect page
Suggested action: upgrade if using an untrusted OIDC provider
If an attacker-controlled OIDC provider generates a redirect URL that contain an HTML injection, and the provider is set to use the form_post response mode, the injected HTML was rendered as-is on the redirect page served to the user. While Javascript execution was blocked by CSP, it allowed an open redirect to an arbitrary URL.
GHSA-w9jj-vpw3-5r8f - Incorrectly saved known host keys for SSH jumphosts with a Web SSH client
Suggested action: upgrade if any targets are accessed via an external jump host. Remove extraneous "known hosts" entries, if any.
When connecting to a new target behind a jump host for the first time via the Web SSH client, accepting the host key prompt creates an extraneous "known host" entry that incorrectly mapped the jump host's key to the target IP. If the attacker gains access to the jump host's private host key and they are able to intercept traffic between the jump host and the target, they could successfully perform a MitM at that connection leg.
Full Changelog: v0.27.5...v0.27.6