Session Fixation / Weak Session
High · Session
OWASP Top 10:2025 (current)
Not directly mapped to a Top 10:2025 category — see CWE / CVE below.
CWE
CWE-384
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
CWE-384
Definition
Predictable or fixable session IDs; missing rotation on login.
Root cause
Poor session lifecycle.
Affected components
- Components in the “Session” class
- Application / API handlers
- Supporting libraries
Impact
Account takeover.
Severity
High
Safe lab reproduction
Auth labs
Detection methodology
Session ID entropy/rotation tests.
Evidence examples
- Lab reproduction notes: Auth labs
- Request/response excerpts (redacted)
- Detection signal: Session ID entropy/rotation tests
Remediation
Regenerate session on login; Secure/HttpOnly/SameSite.
Secure coding examples
Use framework session managers.
Related CYNARKS lessons & labs
Tools: burp
Practise related skills in Labs or deepen on Academy library.