This is not security hole, but the custom code that you have shared.
// When you load global user object
global $user;
// And assign and user object to global $user object.
// Drupal basically change the context of current user.
// Its kind of hacky login by code.
$user = user_load(<any_uid>);