   public OHttpSession removeSession(final String iSessionId) {
     acquireExclusiveLock();
     try {
       return sessions.remove(iSessionId);

     } finally {
       releaseExclusiveLock();
     }
   }

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.