In the description and steps, where it may show a strange value such as "0000007:0000015", that refers to the idle time on the username field. The intended meaning is: leave the page idle for 15 minutes or more, then type the username manually and submit. Sorry for the formatting issue; the report cannot be edited.

where it may show a strange value such as "0000007:0000015"

This is because the tilde character followed by a number creates a link to the corresponding bugnote, i.e. ~15 in this case links to bugnote number 15, belonging to issue 7.

I edited your report to add a space after the ~.

The duration of the session depends on your php.ini settings (see session.gc-maxlifetime as well as gc-probability and gc-divisor).

I'm not aware that the browser's autotype could refresh the PHP session or the MantisBT CSRF token - that's quite surprising to me. Are you sure this is not a red herring ? If this is consistently reproducible it would be interesting to analyze exactly what is happening.

Issue restored from backup following accidental deletion.

You were right about the browser autofill: that was a red herring. I had not measured the idle time accurately. After further checks, the ERROR 2800 occurs consistently after about 15 minutes or more of inactivity on the login page (username step), whether the username is typed manually or chosen from the browser suggestions.

I looked for session.gc_maxlifetime / gc_probability / gc_divisor, but I do not have access to the server php.ini, so I cannot change those settings directly.

We must keep $g_form_security_validation = ON (security remediation and company guidelines).

As a possible workaround on our side, I considered a small plugin that, after roughly 10 minutes of inactivity, reloads the login page when the user returns to the tab or interacts again, so a fresh CSRF token is issued.

Thank you for the guidance provided; I remain open to any further information.