Yes, your concern is justifiable.
From the Set-Cookie documentation at Mozilla:
Indicates a URL path that must exist in the requested resource before sending
the Cookie header. The %x2F ("/") character is interpreted as a directory
separator and sub directories will be matched as well (e.g. path=/docs,
what are the security risks?
The security risk is that there is no security at all to begin with.There is a reason why authentication exists.
Now lets assume that GUID is sufficiently long enough such that brute force is out of the question.But it still gets logged in so many places.
But the real threat is more from powerful crawlers that search engines ...