IanWhalen/Telescope — pull request #2 by c0nrad (2014-07-22 04:20:34+00:00)
Title: Fixed session/cookie login vulnerability.

findOrCreateUser originally trusted whatever cookie was passed in as an argument as valid. The function is also accessable on client side. Becasue of this, maclicious actors could login to other accounts, or create new accounts.

The fix was to double check the cookie and make sure it's the cookie belonging to the corp session.

Example of mal use:
https://news.10gen.com/posts/mFmvqCL2XqsSH83QF