Mysebbe

In multi-tenant deployments using WebAuthn with a shared user pool, the server fails to constrain lookups to the requested tenant and does not verify tenant membership during sign-in. This allows a user with a valid passkey in one tenant to authenticate into another tenant within the same application, even without membership in the target tenant. The issue involves the `loadOptionsById Transaction()` and `getUserInfoByCredentialId Transaction()` functions, as well as the `WebAuthN.signIn` method.

An authorization bypass exists due to missing visibility and publication status checks on the `product id` parameter in AJAX handlers before returning product add-on data. This allows unauthenticated attackers to retrieve add-on configuration and pricing data for products that are not publicly visible, bypassing product visibility restrictions.