The /admin/login endpoint has a design and security issue related to how request parameters are handled and how authentication is performed.
if (email == null || password == null || security_key == null) {
throw new ResponseStatusException(HttpStatus.BAD_REQUEST);
}
@RequestParam String parameters are required by default.
Remove unnecessary null checks and rely on Spring’s parameter validation.