A weakness where attacker-controlled input is accepted as part of session creation or session state. It breaks the trust model of authentication because the application treats request data as if it were proof of identity, allowing unauthorised users to obtain valid sessions.
Expanded Definition
Session injection is a session integrity failure where attacker-controlled material is accepted as part of session establishment, session identifiers, or session state. In NHI and agentic systems, that can mean a service accepts an ID, token, or context value supplied by a requester and then upgrades it into a trusted session without independently proving provenance. The distinction matters: a valid session should emerge from server-side authentication and policy decisions, not from user-controlled input.
Definitions vary across vendors when the issue appears in browser sessions, API sessions, or agent execution contexts, but the core risk is the same. The application confuses request data with proof of identity, which can let an unauthorised actor bind to an existing session or create one that looks legitimate. NIST guidance on session and access control expectations is reflected across NIST SP 800-53 Rev 5 Security and Privacy Controls, especially where authentication, session management, and access enforcement must remain separate responsibilities. The most common misapplication is trusting client-supplied session values as identity proof, which occurs when application code accepts a token, header, or context blob before server-side validation.
Examples and Use Cases
Implementing session handling rigorously often introduces extra state validation and token lifecycle overhead, requiring organisations to weigh stronger trust boundaries against lower application convenience.
- A service accepts a session ID from a query parameter and loads privileged state before verifying whether the requester ever authenticated.
- An API gateway forwards a caller-provided token into downstream services without checking issuer, audience, or binding, creating a path for session confusion.
- An AI agent receives tool context from an upstream request and treats it as authenticated session state, then performs actions with inherited authority.
- A compromised integration injects crafted headers into a microservice chain, causing the receiving service to attach the attacker to an internal session.
- A legacy app reuses browser session cookies across workflows without re-authentication, allowing a fixed or injected identifier to persist into a privileged action.
These patterns are especially relevant in environments with large numbers of service accounts and API keys, where the Ultimate Guide to NHIs shows that NHIs outnumber human identities by 25x to 50x in modern enterprises. In session-heavy automation, the same validation discipline recommended for NIST SP 800-53 Rev 5 Security and Privacy Controls should be applied to every transition where state becomes authoritative.
Why It Matters in NHI Security
Session injection is dangerous because NHI environments rely on machine-to-machine trust, short-lived credentials, and delegated execution. When session state is accepted from the request path, an attacker can bypass authentication controls without needing to steal a secret outright. That undermines Zero Trust assumptions, weakens auditability, and can turn a single integration flaw into broad lateral movement across automation pipelines and service meshes.
The operational impact is amplified by the scale of NHI exposure. NHI Mgmt Group reports that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, and only 5.7% of organisations have full visibility into their service accounts in the Ultimate Guide to NHIs. That means session-bound attacks are often hard to detect until access is already established. Teams should also align controls with NIST SP 800-53 Rev 5 Security and Privacy Controls for authentication, session management, and monitoring so injected state cannot be mistaken for trusted identity.
Organisations typically encounter this consequence only after a service account is used to move laterally or exfiltrate data, at which point session injection becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 | Session trust failures map to improper authentication and session handling in NHI systems. |
| OWASP Agentic AI Top 10 | A-04 | Agent context injection can turn untrusted input into unauthorised execution state. |
| NIST CSF 2.0 | PR.AA-01 | Authentication assurance is broken when session state is accepted from attacker-controlled input. |
| NIST SP 800-63 | Digital identity guidance requires authenticator output, not request data, to establish a session. | |
| NIST Zero Trust (SP 800-207) | AC-4 | Zero Trust forbids implicit trust in session state derived from unverified request inputs. |
Verify session provenance server-side and reject any client-controlled value that can alter authenticated state.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
