  public String createSession(final String iDatabaseName, final String iUserName, final String iUserPassword) {
    acquireExclusiveLock();
    try {
      final String id = "OS" + System.currentTimeMillis() + random.nextLong();
      sessions.put(id, new OHttpSession(id, iDatabaseName, iUserName, iUserPassword));
      return id;

    } finally {
      releaseExclusiveLock();
    }
  }

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.