Defensive Architecture: Logic Analysis: The Burst Statistics Auth Bypass (CVE-2026-5512)

The vulnerability in the Burst Statistics plugin stems from a failure to verify the cryptographic signature of the session token. An attacker can manually craft a cookie where the 'id' field is set to '1' (typically the admin ID). Because the 'decode_token' function only parses the JSON payload without checking the HMAC signature, the system grants full administrative access.

function check_admin_access() {
  $token = $_COOKIE['burst_session'];
  $user_id = decode_token($token)['id'];
  // VULNERABILITY: Missing verification of token signature
  if ($user_id == 1) { return true; }
  return false;
}

The fix involves implementing a 'Strict Signature Check' using a server-side secret key. Every token must be validated against its signature before any fields are trusted. Additionally, moving to a 'Stateful Session' model where tokens are checked against a database of active, valid sessions would prevent this class of 'Client-Side Trust' flaw.