GHSA-hfhv-fmf7-8x37: 
Rust vulnerability analysis and mitigation

SharedSignalsManager::receive_event in OIDC extensions accepted security events without a valid signature while event verification was enabled: an event carrying no signed token was accepted, and when SHARED_SIGNALS_VERIFICATION_KEY was unset a token signed with a fixed constant in the source verified. A caller that exposes receive_event to untrusted senders could be made to revoke sessions, disable accounts or record credential changes. The crate does not itself route network requests to this method. Fixed by requiring a configured key and a signed token; unsigned events now return an error (behaviour change for callers feeding unsigned events).