  public OHttpSession[] getSessions() {
    acquireSharedLock();
    try {

      return (OHttpSession[]) sessions.values().toArray(new OHttpSession[sessions.size()]);

    } finally {
      releaseSharedLock();
    }
  }

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.