    public function getLoginFormURL()
    {
        return './index.php?old_usr=' . $GLOBALS['PHP_AUTH_USER'];
    }
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.