Path traversal may allow arbitrary files to be viewed, created, modified, or deleted

Missing proper authentication for critical APIs may allow sensitive information to be obtained or modified, or unauthorized operations to be performed

A hard-coded JWT signing secret key may allow administrative functions to be abused using fraudulently generated Bearer tokens

Hidden accounts or hard-coded credentials may permit unauthorized access without the legitimate authentication process

Improper authorization may allow a general user to perform operations equivalent to those available with administrator privileges

Authentication information or sensitive data may be intercepted in transit