   public String createSession(final String iDatabaseName, final String iUserName, final String iUserPassword) {
     acquireExclusiveLock();
     try {
       final String id = "OS" + System.currentTimeMillis() + random.nextLong();
       sessions.put(id, new OHttpSession(id, iDatabaseName, iUserName, iUserPassword));
       return id;

     } finally {
       releaseExclusiveLock();
     }
   }

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.