The provided package revision (1.5.0-1) lacks strictly required
audience validation. The revision 1.6.1-1 provided in forky and
sid provides the correct validation mechanisms.

Forensic reference:
Upstream resolved this critical token-substitution vulnerability
via Commit 90fa386 ("Audience fixes") on February 3, 2026. Please
consider a fast-track backport to trixie-stable to preserve OIDC
protocol integrity.

Regards,

Timo Gerke