Local privilege escalation via long-lived session cookie

Insufficient session expiration in Truesec LAPSWebUI before 2.4 allows local users to retrieve local administrator passwords via an old session. When Force Reauth on Password request is disabled, the server accepts an authenticated session cookie at least 13 days after issuance without enforcing a server-side timeout. Access to a workstation holding the cookie is required, and the reused session grants the password-retrieval privileges of the original user.