Cookie Is The Credential

An HTTP endpoint reads a client-set field (cookie, header, body) and treats a well-known value as proof of a privileged identity. The field is not bound to a server-issued session, not derived from a secret, and not signed. The vendor's own UI writes the same value into every legitimate caller's browser after a login flow whose only effect is to set the value; sending the value directly produces the same effect without presenting the password. The credential is a public constant shipped identically across every deployment.