Session Fixation

Vulnerability Details

Severity:

High

Category:

Authentication

Description

The application does not regenerate the session identifier after successful authentication, allowing an attacker to fixate a known session ID and then hijack the session after the victim logs in.

Risks

An attacker could gain full access to a victim's authenticated session, performing any action the victim is authorized to do, including accessing sensitive data and modifying account settings.

Remediation

Regenerate the session identifier immediately after successful authentication. Invalidate old session IDs upon login. Implement session timeout and idle timeout policies. Bind sessions to client properties where feasible.