Administrator access via cross-deployment cookie replay

Authentication bypass in H 1.0 allows remote attackers to obtain administrator access by replaying a captured session cookie. The web interface on port 5005 accepts an administrator cookie issued by a separate H installation instead of binding the session to its originating server. Exploitation requires possession of a valid administrator cookie from any H deployment; replaying it grants access to the target's administrative interface.