The application was vulnerable to a session fixation that could be used hijack accounts.
CWE-384, CWE-384