Attackers force a user to log in with a known session ID, allowing the attacker to reuse it afterward.
Why it matters:
- Gives attackers access even without stealing credentials.
- Exploits poorly designed session management.
Pro tip: Always generate a new session ID after login — this blocks fixation completely.
« Back to Glossary Index