Sijmen_Ruwhof

Session management and authentication (PKI / one time pad) are two complete different subjects. If a session cookies is leaked from a customer, then authentication checks can be bypassed completely. So certainly an issue.

It's almost certainly not a backdoor, as it's way to noisy for that.

Why the random visitor technical details were shown is a really good question. I have spent quite some thought time on that also and couldn't come up with a solid answer.