Vulnerabilities

An insufficiently secured internal function allows session generation for arbitrary users.

The "serverConfig" endpoint, which returns the module configuration including credentials, is accessible without authentication.

The system exposes several endpoints, typically including "/int/" in their path, that should be restricted to internal services, but are instead publicly accessible without authentication to any host able to reach the ap…