In CSoapService::processRequest(), the code queries a pointer to the context userID . In the call to processHeader, that pointer gets changed to point to the password. If an error occurs, the logging attempts to log the userID, but it now points to the pwd
"SOAP method <WUQuery> from MyPassword@127.0.0.1."
Instead of querying a pointer, the code should copy the userid into a StringBuffer