Lza

An authorization bypass exists in the SIWX server extension. Paying clients can unlock unpaid routes by providing a mismatched `PaymentPayload.resource` URL. This allows an attacker to pay for the least expensive SIWX-protected route while specifying a high-cost route in the `resource.url` variable, enabling repeated access to the expensive route using only a SIGN-IN-WITH-X header without additional payment.

An XML external entity (XXE) injection exists when the software processes XML through an unhardened DocumentBuilderFactory with external entities and DTD loading enabled. Authenticated attackers can exploit this by supplying a crafted `taskScript` payload to the 'doEditWorkflow' endpoint. This allows for server-side request forgery (SSRF), where the server is forced to make outbound HTTP requests to attacker-controlled infrastructure, and out-of-band file exfiltration of local files readable by the TIS process user, such as configuration files and Derby database credentials.

An unauthorized access issue exists due to a hard-coded JWT signing secret within the `application-maxkey.properties` file. This allows unauthenticated attackers to forge valid JSON Web Tokens (JWT)—a compact, URL-safe means of representing claims to be transferred between two parties—and authenticate as any user. By utilizing the password-skipped login mechanism, attackers can sign a token with the default secret and submit it to the `/sign/login/jwt/trust` endpoint to obtain an authenticated administrator session, granting access to SSO application configurations and downstream application secrets.

An issue exists in GlueFactory that allows the execution of unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can manipulate the script field through message template endpoints to execute arbitrary Groovy code and operating system commands on the backend server.