Vendor
A missing Sa-Token interceptor in LangChat allows unauthenticated remote attackers to access sensitive REST controllers, leading to full system compromise and credential exfiltration.