Session mismatch leading to potential account takeover (local access required)

Cloudflare Public Bug Bounty disclosed a bug submitted by ostracize: https://hackerone.com/reports/1825227 – Bounty: $350