Command execution via one-time expired-token reuse

Insufficient session expiration in SaltStack Salt before 3002.5 allows remote attackers to execute commands with an expired eAuth token. The eAuth token-validation method returns usable token data for the first request after expiry instead of rejecting it with an empty result. Exploitation requires possession of a previously issued token and permits one post-expiration command against the Salt master or managed minions.