This also comes as the organization is preparing a coordinated update to fix 2 CVEs in the protocol [1], that were originally reported 6 months ago.
I would be interested in learning more context around this issue once you are able to share, so hopefully there will be a report/post/etc after the embargo lifts.