Substantially weakened authenticity verification when using 'Remember me for a week'

I noticed that in order to access data bound to a user's permissions, say their own bug reports, or CSRF-token, you only need one certain cookie, which is , and although it is sent when the user uses HackerOne in a normal fashion, the cookie is ignored and thus not required. This only works if the …

Both cookies are values base64-encoded values. Decoding the