CVE-2026-114082: Downstream Credential Issued With Wildcard Prefix Scopecve-2026-114082-downstream-credential-issued-with-wildcard-prefix-scope
This access-token issuance request scopes the credential to a wildcard stream prefix (`streams: { prefix: ... }`) with `auto_prefix_streams: true`, so the minted token is valid for every stream under the environment prefix instead of only the resource being authorized. If this token is handed to a client (e.g. returned in a response header), a caller authori
