Ehm.. if it smells like a rat and looks like a rat it proppably is a rat..

But I'll answer your question anyway..

Seem that vBulletin also require sessionhash ?
Yes
And the cookie usually doesn't contain the actual password but a password hash..