[GHSA] GHSA-6hxq-p678-4hr2 (low) — SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor

GHSA-6hxq-p678-4hr2 Severity: low CVE: None

SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor

## Summary `validateCertificatePath()` does not verify that an attestation's certificate chain actually terminates at a configured trust anchor. When walking the chain it stops at the first self-signed certificate it finds (which