Plumb totp passcode through openIdAuth action
feat(auth): plumb totp passcode through openIdAuth action
Plumb totp passcode through openIdAuth action546db0-feat-plumb-totp-passcode-through-openidauth-action-cve-2026-34727featplumb totp passcode through openidauth action
Committed by kolaente
commit message
feat(auth): plumb totp passcode through openIdAuth action
Allows the OpenIdAuth view to resubmit the OIDC callback with a
TOTP passcode after a 412/1017 response from the backend.
Refs GHSA-8jvc-mcx6-r4cgEditor assessment
This commit patches CVE-2026-34727. The subject, feat(auth): plumb totp passcode through openIdAuth action, describes the plumbing but not why the passcode now needs to be resubmitted. The two-line body supplies that context, explaining that the OpenIdAuth view can retry the OIDC callback with a TOTP passcode after a 412 response from the backend, and the Refs footer points at the advisory. Calling it feat is defensible for new behavior though it is security-motivated. The jargon plumb and the missing statement of the bypass fixed keep it from being exemplary.