static void __hidp_unlink_session(struct hidp_session *session)
{
	hci_conn_put_device(session->conn);

	list_del(&session->list);
}

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.