In Odoo after user is authenticated it create session id and set it in cookies without any encryption so basically it exposed to user and he can see it and can copy.
Now the problem is we can play with the session id by exchanging(between two users) and pasting it in cookies and it will replace the user completely.
For example if user A shared his session id to me and I updated it in my cookies my user will be turn into User A.
Though It's not any critical level vulnerability because an authenticated session has been shared, but still any idea, how can we restrict it to not let this happens?