Chakrapani150

Insufficient session expiration occurs in TokenStorage.php within the `findTriplet()` function. The issue arises because the expiry check compares an array to a scalar value, which always evaluates incorrectly in PHP. This allows an attacker who has captured a Remember Me cookie to maintain authentication indefinitely, bypassing the configured timeout period.

Insufficient AST (Abstract Syntax Tree) validation of workflow script steps allows for remote code execution. An attacker can craft malicious YAML workflow files containing `import os` statements and `os.system()` calls to bypass sandbox restrictions and execute arbitrary operating system commands with the privileges of the running process. This occurs within the `JobWorkflowExecutor. exec inline python()` function.

A prompt injection defense misconfiguration exists where the block threshold defaults to CRITICAL severity. This allows threats categorized as HIGH severity to pass through without being blocked. Attackers can utilize single-vector prompt injection attacks, such as instruction overrides or financial manipulation, which trigger HIGH severity detection but are only logged. This flaw enables the extraction of system prompts and unauthorized tool invocations.

The Guest API 'invoice/update' endpoint lacks an authorization check. This allows an unauthenticated user who possesses an invoice hash to modify the payment gateway of an unpaid invoice by changing the `gateway id` variable to any payment gateway already configured in the system. Invoice hashes may be exposed through email links, referrer headers, or shared URLs. The impact is limited by the `invoice accessible from hash` system setting and the requirement that the gateway must be pre-installed by an administrator.