The letter mentions OAuth but doesn't mention the ongoing work to address the https://eprint.iacr.org/2025/629 findings, CVE-2025-27371.