Zscaler stored Device Token Authentication credentials in Windows registry in clear text, allowing local attackers to extract tokens and impersonate any user by modifying registry values.