The application uses a serialisation-based session mechanism and is vulnerable to authentication bypass as a result.