  public OHttpSession removeSession(final String iSessionId) {
    acquireExclusiveLock();
    try {
      return sessions.remove(iSessionId);

    } finally {
      releaseExclusiveLock();
    }
  }

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.