Regardless of what the root cause is (I didn’t have enough time to investigate), no one should see someone else’s bookings and booking references when logging in. It is clearly an application issue, as in not a browser issue.