8.6.42 (2026-03-13) Bug Fixes Session creation endpoint allows overwriting server-generated session fields (GHSA-5v7g-9h8f-8pgg) (#10196) (2021b27)