Unauthenticated booking cancellation via guessable tokens

Weak token generation in Themefic Hydra Booking 1.1.27 and earlier allows remote attackers to cancel arbitrary bookings via an AJAX request. The tfhb_meeting_form_submit_callback function creates insufficiently random cancellation tokens and pairs them with a globally shared nonce accepted by the tfhb_meeting_form_cencel endpoint. No authentication or user interaction is required, but successful cancellation requires brute-forcing a valid token; the demonstrated consequence is unauthorized modification of booking state.