[rt-users] 3.8.x serious security issue with mixing sessions

[Thierry Thelliez]

I just found this thread about Mixed sessions. We are experiencing the
same problem with RT 3.8.7, sitting behind an Apache based proxy +
load balancer. The backend is a MySQL cluster but that should not have
an impact on the user sessions.

We have two instances of RT connected to the same backend.  In other
words, the front ends connect (load balance) to two RTs. These RTs
connect to the same Cluster.

Could the apache load balancer be the issue?

Suggestions?
Thierry