CWE-384 is a weakness class for session fixation, where an attacker sets or predicts a session identifier before the user authenticates. The flaw appears when an application accepts that pre-existing ID after login instead of issuing a new one, allowing the attacker to ride the authenticated session.
How session fixation works
Session fixation is dangerous because the attacker does not need to steal a fresh session after login, they only need the victim to authenticate while still using an attacker-chosen identifier. Once the application preserves that identifier across authentication, the attacker can attach to the same authenticated context and act as the user.
This weakness is usually about session rotation and strict session handling, not just cookie storage. The critical failure is accepting a pre-existing session state instead of replacing it at the authentication boundary.
Why the vulnerability is exploitable
The attack succeeds when the session identifier is predictable, user-controlled, or otherwise reusable across the login step. That can happen through URL-based session IDs, permissive framework defaults, weak regeneration logic, or application flows that authenticate the user without invalidating the original session.
The CWE Top 25 Guide is useful context because session fixation sits in the wider class of high-impact web weaknesses that turn small implementation errors into account compromise. The underlying problem is not the identifier itself, but the application’s trust in a session that should no longer be authoritative after login.
How organisations verify exposure and reduce attack surface
Exposure review starts with checking whether the application regenerates session IDs immediately after successful authentication and whether every login path, including SSO callbacks and reauthentication flows, follows the same rule. Teams should also inspect whether session tokens can be set through URLs, predictable cookies, subdomain injection, or framework defaults that allow session persistence before authentication.
That review is stronger when paired with a broader understanding of CVE, CWE and CPE mapping, because it helps teams separate a weakness pattern from any specific product instance or deployment. For session fixation, the decisive questions are where the session is created, when it is rotated, and whether any path lets an attacker plant the identifier first.
Remediation, detection and post-incident review
Remediation usually means forcing a new session identifier on authentication, invalidating the pre-login session, hardening cookie handling, and verifying the behaviour in tests rather than assuming the framework handles it safely. Applications should also avoid exposing session IDs in URLs and should treat session lifecycle bugs as authentication defects, not cosmetic issues.
Detection and review focus on signs that a session remained valid across login or that the same identifier was used from different contexts around the authentication event. After suspected exploitation, organisations should review active sessions, rotate any downstream secrets or tokens tied to the account, and look for actions taken immediately after authentication that would indicate a hijacked authenticated session.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP ASVS and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V7 — Session Management | Session fixation is a session management failure at login boundary handling. |
| V10 — OAuth and OIDC | SSO and federation flows must still rotate session state after identity assertions. | |
| Recommendation — Enforce session renewal on authentication and validate session lifecycle controls. Verify federated login flows still issue a fresh application session after successful assertion. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Session fixation often persists through weak credential and session lifecycle handling. |
| AC-12 — Session Termination | Fixation depends on sessions remaining valid when they should be replaced or ended. | |
| IA-2 — Identification and Authentication (Organizational Users) | The weakness exploits the transition into an authenticated user session. | |
| Recommendation — Rotate or invalidate session-related authenticators and secrets after authentication events. Terminate pre-authentication sessions and invalidate stale session state on login. Bind authentication success to a newly issued session rather than reusing the old one. | ||
Related resources from NHI Mgmt Group
- What do teams get wrong when they rely on top CWE rankings alone?
- Why do repeat CWE classes keep causing breaches even when teams know about them?
- How should security teams use the CWE Top 25 and OWASP Top 10 together without duplicating work?
- Why do CWE-level findings provide stronger audit evidence than OWASP category labels?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org