Vendor 2 acknowledged the weakness, yet wrote us: "Session cookies are not a replacement for authentication tokens."

Keep-session-cookies saves the session cookies instead of keeping them in memory, which is useful on sites that require access to other pages.

The ability to forge such session cookies (or more generally, session tokens) stems from the fact that the tokens are not generated in a secure way.