PAD Site Scripts 3.6 allows remote attackers to bypass authentication and gain privileges as other users including administrative privileges by setting the authuser cookie parameter to a valid username.