In the authentication api there are two functions that perform quite similar actions: auth_is_cookie_valid and auth_get_current_user_id. The first one returns true if only one match is found on the DB for the cookie, but the second only checks for zero matches, thus continuing if multiple matches are found (and probably producing later an error if this happens).

Without direct modification of tables, it is probably not possible to have duplicated cookie strings stored on database, but this is a bug (quite minor) anyway.