Klarna users are being signed in to random accounts

I suspect this might be request threading/confusion[0] issue similar to the one GitHub experienced a while back. This would explain why seemingly random user data is being returned.

0: https://github.blog/2021-03-18-how-we-found-and-fixed-a-rare...

We can only speculate, but what baffles me is that it happens for something so private, and for a company that is so rich. Do they not audit their code? Do they not risk assess these things? "Ah, storing user credentials in thread local storage, that sounds sane and bug-proof" said no auditor, ever.

IIRC, Klarna is mostly written in Erlang, Scala and some parts in Clojure.

If someone should be aware of thread-local storage and its implication it ought to be them.

I was under the impression that they had switched to Java more in recent years

Using trendy tech doesn't solve much by itself. Especially if you can't (or don't) compete with FAANG on compensation.

This has changed many years ago.