An issue allows unauthorized access to a user's account if the browser is closed without logging out of Mahara. The value in the `usr session` table remains, and an attacker can exploit this by adjusting the `mahara` cookie to the old value, thus gaining access to the user's account.