Builtbybrayden

An issue exists in the `ApiAssetsController::store` function where plaintext is written into custom-field columns flagged for encryption when the caller lacks the `assets.view.encrypted custom fields` permission. Authenticated API users without this permission can create assets with sensitive custom-field values that remain unencrypted in the database, potentially exposing the data through backups, replicas, or direct database access.

An authentication bypass exists in the `handleGoogleCallback()` function within the `GoogleAuthController`. The system logs in users whose usernames match the Google account email without verifying the activated flag. Consequently, deactivated users who possess email-formatted usernames and active Google identities can authenticate via Google SSO to regain access with their previous permission levels, including administrative privileges.

The software fails to check the return value of the `ldap start tls()` function within the `connectToLdap()` function. This allows an on-path attacker to force cleartext LDAP binds by responding to the StartTLS request with a protocol error, enabling the capture of service-account credentials and end-user login passwords.

A SAML assertion replay issue exists due to a non-atomic nonce check in the SAML acs handler. This allows attackers to reuse captured assertions by sending concurrent POST requests to the '/saml/acs' endpoint. By doing so, they can obtain multiple authenticated victim sessions that bypass revocation driven by the Identity Provider (IdP).

Authenticated users with edit permissions but without checkout permissions can bypass authorization checks when updating assets. By sending specific parameters to the 'PATCH /api/v1/hardware/{id}' endpoint, an attacker can reassign assets, bypass check-in procedures, and modify custody records. The affected parameters are `assigned user`, `assigned asset`, and `assigned location`.