Jasig/phpCAS — Issue #21: Plaintext Usernames in $_SESSION
Author: patrick-mcdougle
Created: 2012-01-31 16:19:03+00:00
State: open

Since usernames stored as plaintext in the session, it is sufficiently easy to become any user if the attacker can execute php on the same server. Proof of concept here: