What is Session Fixation (CWE-384)?

TL;DR: Session Fixation (CWE-384) is a vulnerability where an attacker can hijack authenticated sessions by exploiting pre-existing session IDs. To prevent this, always invalidate old session tokens during login.

What is Session Fixation?

Session Fixation (CWE-384) is a type of authentication vulnerability that occurs when an existing session identifier is not invalidated before establishing a new user session. As defined by the MITRE Corporation under CWE-384, and classified by the OWASP Foundation under A07:2025 - Authentication Failures, this weakness allows attackers to hijack authenticated sessions.

Quick Summary

Session Fixation vulnerabilities can lead to unauthorized access and compromise sensitive data. Attackers exploit pre-existing session tokens to gain control over user accounts. This vulnerability is critical for web applications handling authentication processes. Jump to: What is Session Fixation? · Quick Summary · Overview · How It Works · Business Impact · Attack Scenario · Detection · Fixes · Framework-Specific Fixes · Ask AI · Best Practices · FAQ · Related Vulnerabilities

Jump to: Quick Summary · Session Fixation Overview · How Session Fixation Works · Business Impact of Session Fixation · Session Fixation Attack Scenario · How to Detect Session Fixation · How to Fix Session Fixation · Framework-Specific Fixes for Session Fixation · How to Ask AI to Check Your Code for Session Fixation · Session Fixation Best Practices Checklist · Session Fixation FAQ · Vulnerabilities Related to Session Fixation · References · Scan Your Own Site

Session Fixation Overview

What: Session Fixation occurs when a user logs into an application with an existing session identifier that was previously compromised.

Why it matters: This vulnerability allows attackers to hijack authenticated sessions and perform unauthorized actions on behalf of the victim, leading to severe security risks.

Where it occurs: In web applications where authentication mechanisms do not properly invalidate old session tokens upon login.

Who is affected: Any user whose session token can be compromised by an attacker.

Who is NOT affected: Applications that automatically generate new session identifiers for each login and enforce strict session management practices.

How Session Fixation Works

Root Cause

The root cause of session fixation lies in the failure to invalidate existing session tokens before establishing a new one. This allows attackers to exploit pre-existing session IDs, leading to unauthorized access.

Attack Flow

1. An attacker obtains or guesses an existing session identifier.
2. The attacker convinces the victim to use this session ID during login.
3. Upon successful authentication, the attacker hijacks the authenticated session and gains unauthorized access.

Prerequisites to Exploit

• Existing session tokens must be valid and accessible.
• Authentication mechanisms should not invalidate old sessions upon new logins.

Vulnerable Code

def authenticate_user(request):
    session_id = request.cookies.get('sessionid')
    # No check to invalidate existing session tokens

This code does not invalidate any pre-existing session tokens, making it vulnerable to session fixation attacks.

Secure Code

import random
import string

def authenticate_user(request):
    if 'sessionid' in request.cookies:
        del request.session['sessionid']
    new_session_id = ''.join(random.choices(string.ascii_letters + string.digits, k=32))
    request.session['sessionid'] = new_session_id

The secure code ensures that any existing session tokens are invalidated before establishing a new one.

Business Impact of Session Fixation

Confidentiality

• Data access: Attackers can read sensitive information stored in user sessions.
• Authentication bypass: Unauthorized users gain access to restricted areas and data.

Integrity

• Data modification: Attackers may alter or delete data within the compromised session.

Availability

• Service disruption: Sessions can be terminated, leading to denial of service for legitimate users.

Session Fixation Attack Scenario

1. An attacker identifies a user’s pre-existing session identifier.
2. The attacker sends an email with a link containing this session ID.
3. The victim clicks the link and logs into their account using the compromised token.
4. Upon successful login, the attacker hijacks the authenticated session.

How to Detect Session Fixation

Manual Testing

• Check if existing session tokens are invalidated upon new logins.
• Verify that session identifiers are randomly generated for each authentication event.

Automated Scanners (SAST / DAST)

Static analysis can detect hard-coded or predictable session token generation logic. Dynamic testing is necessary to confirm actual behavior during runtime.

PenScan Detection

PenScan’s scanner engines such as ZAP, Nuclei, Wapiti, Nikto, SSLyze, Dalfox, and Nmap can identify potential session fixation vulnerabilities in web applications.

False Positive Guidance

False positives may occur if the code appears to invalidate sessions but does so under specific conditions not covered by automated scans. Manual review is necessary to confirm true positives.

How to Fix Session Fixation

• Invalidate any existing session identifiers before authorizing a new user session.
• Generate secure random values for session tokens upon successful authentication.

Framework-Specific Fixes for Session Fixation

Python/Django

import secrets

def authenticate_user(request):
    if 'sessionid' in request.session:
        del request.session['sessionid']
    new_session_id = secrets.token_hex(16)
    request.session['sessionid'] = new_session_id

How to Ask AI to Check Your Code for Session Fixation

Session Fixation Best Practices Checklist

✅ Invalidate any existing session tokens before establishing a new one. ✅ Generate secure, unpredictable session identifiers upon successful authentication. ✅ Use secure random value generators to create session IDs.

Session Fixation FAQ

How does session fixation occur?

Session fixation occurs when a user logs into an application with an existing session identifier that was previously compromised by an attacker.

Why is session fixation dangerous?

It allows attackers to hijack authenticated sessions and gain unauthorized access to sensitive data or perform actions on behalf of the victim.

What are some common attack vectors for session fixation?

Attackers often exploit vulnerabilities in authentication mechanisms, such as setting a known session ID before user login or manipulating session tokens after authentication.

How can developers detect session fixation issues manually?

Developers should review code that handles session management and ensure it invalidates existing sessions upon successful logins.

What are the best practices to prevent session fixation?

Invalidate any existing session identifiers before authorizing a new user session and use secure random values for session tokens.

How can an application firewall help mitigate session fixation attacks?

An application firewall can detect suspicious patterns in session management requests and block potential attack attempts.

What are the common consequences of session fixation vulnerabilities?

They primarily affect access control, allowing unauthorized users to gain privileges or assume identities.

Vulnerabilities Related to Session Fixation

References

• MITRE
• OWASP A07:2025 - Authentication Failures
• CAPEC 196, 21, 31, 39, 59, 60, 61
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Session Fixation and other risks before an attacker does.