Vulnerabilities

An authenticated user's token could be used by another source after the user had logged out prior to the token expiring.

An authenticated user without user-management permissions could identify other user accounts.

An administrator could discover another account's credentials.

An authenticated user without user-management permissions could view other users account information.

An authenticated administrator could modify the Created By username for a user account

Users who were required to change their password could still access system information before changing their password

A suspended or recently logged-out user could continue to interact with Blueframe until the time-out period occurred.

An authenticated user without user administrative permissions could change the administrator Account Name.

An unauthenticated user could discover account credentials via a brute-force attack without rate limiting