Brekeke SIP Server: Authentication Fail-Open Exposes 23 Unauthenticated Beans

A self-developed ScopeBean.checkScope() that fails open for any bean with an undeclared scope, combined with an attacker-controlled GateServlet bean parameter, leaves 23 beans reachable without authentication — including the two sinks that power the downstream RCE chains.