vBulletin Session stealing works

[silvermerc]

Apparently using things such as this;
**edit: html removed by Lynne**
Will work if the HTML is enabled, surely theres a way to present session stealing?
Btw i got this code from a user attempting to use this
Ross

[Lynne]

You should not be allowing users to use html on your forums because of things like this (removed by me, btw). There are many malicious things a user may do when html is enabled.

[nexialys]

yeap... but 99.99% of all the vBulletin sites are deactivating HTML for that exact reason, for once, and also, there is no session details in the cookie, just sessionID, the password is hashed... the system is more secure than you think. this basic html code is known for ages though...

[silvermerc]

yeap... but 99.99% of all the vBulletin sites are deactivating HTML for that exact reason, for once, and also, there is no session details in the cookie, just sessionID, the password is hashed... the system is more secure than you think. this basic html code is known for ages though...
What so with the cookies they coulnt log into your user?
Yeh but i can't see why vb woulnt block it :S

[Dismounted]

How do you propose vBulletin block cookies which are used to authenticate users?