Session Fixation

Session fixation is an attack where an adversary sets or predicts a user's session identifier before authentication, then exploits the session after the victim logs in. If an application maintains the same session ID across authentication state changes, the attacker who knew the pre-authentication ID gains an authenticated session.

Prevention requires generating a new session identifier upon successful authentication.