Authentication-token exposure via redirect query strings

Sensitive-data exposure in Webkul QloApps 1.6.1 allows local users to obtain authentication tokens from redirected URLs. Redirects for the admin panel and other protected areas append the token directly to the URL query string, where browser history, referrer data, logs, proxies, or plaintext traffic can retain it. Access to one of those records or an unsecured connection is required; reuse of an exposed token enables session hijacking and unauthorized administrative actions.