<p>1) user A goes to the site, creates an account, and logs in
2) user b goes to the site.  Rather than having to log in, user b enters as though user b is user a.  User b gets access to all of user a's data and can brows the site as user a.</p>

<p>Note: user b does not log in.  User b just hits the site, and the site returns as if user b is already logged in as user a.</p>

<p>Note 2: user a and user b are on distinct computers.  Also, static variables are not involved in the code.</p>

<p>Setup:
IIS 6
.Net 2.0
OutputCache off for the pages in the site</p>

This question seems quite similar to
Apache/Tomcat error - wrong pages being delivered
. As
my answer
to that question mentions, if you use session cookies, check if your
```
Vary
```
header is correct.