It requires sniffing your own session credentials first, which I don't see as a security vulnerability. The only thing it allows you to do is sell your ticket,

It requires sniffing your own session credentials first, which I don't see as a security vulnerability. The only thing it allows you to do is sell your ticket, which is legal to do.