Regression introduced in Mantis 2.28.0, also duplicated in 2.28.1.

Client:
Windows 11 Pro 25H2
Google Chrome Version 146.0.7680.154 (Official Build) (64-bit)

Server:
Mantis 2.28.1 or 2.28.0
php-8.2.30
Apache httpd 2.4.62
mariadb-10.5.29
Red Hat Enterprise Linux release 9.7 (Plow)

Selected /etc/php.ini configuration:
session.gc_maxlifetime = 3600
session.name = __Secure-PHPSESSID
session.use_only_cookies = 1

Selected Apache configuration settings from httpd.conf:
Header set X-Frame-Options "SAMEORIGIN"
Header always set X-Content-Type-Options: nosniff
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

Mantis config/config_inc.php:
$g_form_security_validation = ON

Login to Mantis using Google Chrome via HTTPS URL.
View Issues.
Open any issue.
Scroll down to Add Note.
Enter a few random words of note text, click Add Note.
Time from loading the issue page to clicking Add Note is less than 1 minute, so not a session timeout.

APPLICATION ERROR #2800

Invalid form security token. This could be caused by a session timeout, or accidentally submitting the form twice.

Please use the "Back" button in your web browser to return to the previous page. There you can correct whatever problems were identified in this error or select another action. You can also click an option from the menu bar to go directly to a new section.

Detailed error information
Full path: /var/www/html/mantis/core/form_api.php
Line number: 157
Stack trace
#   Filename    Line    Class   Type    Function    Args
0   /var/www/html/mantis/core/form_api.php  157 -   -   trigger_error   <string>'2800', <integer>256
1   /var/www/html/mantis/bugnote_add.php    44  -   -   form_security_validate  <string>'bugnote_add'

Clearing web browser cookies and cache did not resolve the error.

I read Mantis docs "9.1.1. Error 2800 - Invalid form security token" and it did not resolve the issue.
https://mantisbt.org/docs/master/en-US/Admin_Guide/html-desktop/#admin.troubleshooting.errors.2800

Workarounds:
1) Rolling back to Mantis 2.27.3 resolves the issue, allowing the Add Note to add to an issue.
2) In config/config_inc.php, setting the following allows editing with Mantis 2.28.1 and 2.28.0:
$g_form_security_validation = OFF