🚨 CVE-2026-77172
App passwords were allowed to bypass password confirmation on sensitive endpoints.