Race condition in Macromedia JRun 4.0 ColdFusion MX 6.1 and 7.0 when under heavy load causes JRun to assign a duplicate authentication token to multiple sessions which could allow authenticated users to gain privileges as other users.