OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call.