{
  "slug": "session-fixation",
  "url": "https://library.infinity8labs.com/session-fixation/",
  "title": "Session fixation",
  "short": "Session fixation",
  "aliases": [
    "Session identifier fixation",
    "Pre-authentication session reuse",
    "Session adoption"
  ],
  "summary": "Session fixation occurs when an application keeps the same session identifier after login or a privilege change. An attacker who knows or sets the pre-login identifier may be able to reuse it as an authenticated session.",
  "cwe": [
    "CWE-384"
  ],
  "owasp": "A07:2021 Identification and Authentication Failures",
  "typical_severity": {
    "min": "medium",
    "max": "high"
  },
  "updated": "2026-10-15",
  "references": [
    {
      "title": "CWE-384: Session Fixation",
      "url": "https://cwe.mitre.org/data/definitions/384.html"
    },
    {
      "title": "OWASP Session Management Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"
    },
    {
      "title": "OWASP Session Fixation",
      "url": "https://owasp.org/www-community/attacks/Session_fixation"
    },
    {
      "title": "OWASP Top 10 A07:2021 Identification and Authentication Failures",
      "url": "https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/"
    }
  ],
  "sections": [
    "https://library.infinity8labs.com/session-fixation/#overview",
    "https://library.infinity8labs.com/session-fixation/#impact",
    "https://library.infinity8labs.com/session-fixation/#examples",
    "https://library.infinity8labs.com/session-fixation/#remediation",
    "https://library.infinity8labs.com/session-fixation/#testing",
    "https://library.infinity8labs.com/session-fixation/#references"
  ]
}