Privilege escalation via colon-delimited username confusion

Authorization bypass in Orthanc 1.12.9 and earlier allows remote authenticated users to impersonate privileged accounts via Basic Auth. HttpServer authenticates the complete Base64-encoded username-password string, but GetAuthenticatedUsername splits the decoded value at the first colon, so a colon-bearing username is reported to authorization filters as a different user. Exploitation requires an administrator to register the crafted username and a Lua request filter that bases access rules on usernames; successful requests receive the impersonated account's privileges.