The issue that #896 fixes requires an attacker to know the username and password beforehand, so the attack surface is not critical but should still be treated as a significant security vulnerability nonetheless.
What's Changed
Features
Bug Fixes
- Fix temporary login token auth being fully authenticated by @Flaminel in #896
- Fix TLS certificate validation being skipped for all HTTPS connections by @Flaminel in #897
Maintenance
Full Changelog: v2.11.0...v2.11.1