N-central unauthenticated sessionID generation

N-central versions before 2025.4 can create valid session IDs for users who haven't logged in. This allows attackers to impersonate users or bypass authentication checks.

N-central < 2025.4 generates valid sessionIDs without requiring prior authentication, enabling unauthenticated attackers to obtain legitimate session tokens. An attacker can leverage these tokens to access protected resources or perform actions as if they were an authenticated user, bypassing the application's access control mechanisms.