I was bug hunting an application — my first time ever — and I started with IDOR. After hours of searching, I found a variable in the cookie called "ldsession", which is a unique 30-character session ID. When I created a second account and copied this session ID into the new one, it signed in successfully.

So, with just one variable, I was able to log into another account.

My question is: Is this a valid bug? And is there any way to discover other users' ldsession values — for example, by visiting their profile pages?