It read somewhat like there was a separate DB with everyone's credentials in it and some api call to get your own credentials...with an unintended way to change

It read somewhat like there was a separate DB with everyone's credentials in it and some api call to get your own credentials...with an unintended way to change the parameters from cred_get("me") to cred_get("arbitrary_account").