I have examined a web application, and I have found some strange behaviour of tokens. I will try to explain it.
I think OAuth2 is used for authorization.
User Alice will login to the app, in the HTTP headers there is an item Authorization: alice_token.
User Bob will login to the app, in the HTTP headers there is also an item Authorization: bob_token.
However if I take alice_token and inject it to HTTP headers of Bob, I can see in the web application everything like Alice, even though I am still logged in as Bob (it will not switch the account, I only get data which is not Bob's).
I know, that in real situation it will not be easy to steal alice_token, because communication is encrypted (HTTPS). I think the probability of abuse is low, but I don't think it is correct solution of authorization. Maybe, I am wrong, and this is my question.
Is this scenario a real problem? Can I classify it as a vulnerability or not?