Vulnerabilities
Session Fixation Mistakes: 7 Errors That Compromise User Identity
Reusing session identifiers across authentication boundaries allows attackers to hijack accounts without guessing credentials or exploiting code flaws.
session fixation
Everything AppSec Scoop has reported about session fixation: 2 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
Stop Session Fixation: Binding Tokens to Users and Devices
Changing session identifiers after login fails if the application reuses the same token for authenticated and unauthenticated states in the same request cycle.