GO-2025-4180: Step CA Has Authorization Bypass in ACME and SCEP Provisioners in github.com/smallstep/certificates
GO-2025-4181: step-ca Has Improper Authorization Check for SSH Certificate Revocation in github.com/smallstep/certificates
GO-2026-4775: step-ca has Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18) in github.com/smallstep/certificates