I Haven't explored the ID generation part.

Yes, I know it is too hard to guess and find someone ID. But the UserID they are storing in the Cookie, so by social engineering or MITM attacker can steal and get access to another user accounts