I discovered that if I remove my auth cookies from my browser's request header, I am still able to view a page.
Log into my WordPress installation
Go to the wp-admin page
In Chrome, use the developer Network tab and copy the headers for accessing a page
Paste the cookie into Dev HTTP Client
Remove all the cookies
The output reveals that I am still able to access the admin page
Is this a vulnerability? If I have removed the auth cookies, shouldn't WordPress be able to retrieve the logged in user?