Comment by jjcm

It requires sniffing your own session credentials first, which I don't see as a security vulnerability.

The only thing it allows you to do is sell your ticket, which is legal to do.