Exchange Webmail Mailbox Hopping

Additional info: I dug through the debug logs today and very clearly found that the F5 APM is reusing active session IDs for other users. Pretty wild, honestly. Of all the eight digit values that it could use it seems to be reusing the same ones. I had around five users logged in at the time of the issue and I see one single user that hops around three other session IDs that were active for other users. 

I also found a particular log message that may be of interest here. I think that number in bold is a hash value. If that's true, I'm seeing that same hash value in another session ID, which would indicate a hash collision. I haven't confirmed that the value is a hash though. Still trying to find that in the docs. 

-Feb 13 09:03:05 MAR-DMZ-F5-1.tmn.int debug websso.1[22102]: 014d0052:7: /AppName/ProfileName:AppName:3e530281:init webssoConfig from data: 0x7ff454047c18, len: 614