Session fixation

Steps to reproduce

  1. Open example.com/login.
  2. Open browser devtools.
  3. Get value for SESSION cookie.
  4. Open example.com/login in the incognito tab.
  5. In the incognito tab, change cookie value to the one, obtained in step 3.
  6. In the normal tab (the one from steps 1-3) log in as any user.
  7. Refresh page in the incognito tab.

Result

You are now logged in the incognito tab as user from step 6 as well.