Someone I know is registered on a community website where they can exchange messages etc. Taking a look at the email notification they receive when something new has been posted, contains an image with a link to their website, something like:
Where the last part seems to be some kind of a user's unique hash, that when you follow that link brings you directly onto the website under the user account, no authentication required!
A bit puzzled, I did the test and tried it out copying the link and using it on a different system in which that website has never been accessed before and sure enough with only that URL I could log into the user account without a hitch.
Looking at the cookies stored for this website, one is a PHPSESSID which value doesn't match the ID from the URL, so clearly that hash element must refer to a user account on the server, bypassing all sort of authentication.
I'm no expert in web-tech, but out of curiosity what kind of authentication is this called? Is it a popular way of logging user? This, to me, doesn't look secure at all (i.e. sniffing network can reveal this info straight away).