CAPEC-59

How the attack unfolds

1. Explore

   The attacker looks for a way in.

   1. [Find Session IDs] The attacker interacts with the target host and finds that session IDs are used to authenticate users.

      2 techniques

      • An attacker makes many anonymous connections and records the session IDs assigned.
      • An attacker makes authorized connections and records the session tokens or credentials issued.

   2. [Characterize IDs] The attacker studies the characteristics of the session ID (size, format, etc.). As a results the attacker finds that legitimate session IDs are predictable.

      3 techniques

      • Cryptanalysis. The attacker uses cryptanalysis to determine if the session IDs contain any cryptographic protections.
      • Pattern tests. The attacker looks for patterns (odd/even, repetition, multiples, or other arithmetic relationships) between IDs
      • Comparison against time. The attacker plots or compares the issued IDs to the time they were issued to check for correlation.

2. Experiment

   They probe what they found.

   3. [Match issued IDs] The attacker brute forces different values of session ID and manages to predict a valid session ID.

      1 technique

      • The attacker models the session ID algorithm enough to produce a compatible session IDs, or just one match.

3. Exploit

   They carry out the attack.

   4. [Use matched Session ID] The attacker uses the falsified session ID to access the target system.

      2 techniques

      • The attacker loads the session ID into their web browser and browses to restricted data or functionality.
      • The attacker loads the session ID into their network communications and impersonates a legitimate user to gain access to data or functionality.

Prerequisites

• The target host uses session IDs to keep track of the users.

• Session IDs are used to control access to resources.

• The session IDs used by the target host are predictable. For example, the session IDs are generated using predictable information (e.g., time).

Skills required

• Low skill

  There are tools to brute force session ID. Those tools require a low level of knowledge.

• Medium skill

  Predicting Session ID may require more computation work which uses advanced analysis such as statistical analysis.

Consequences

Mitigations

• Use a strong source of randomness to generate a session ID.

• Use adequate length session IDs

• Do not use information available to the user in order to generate session ID (e.g., time).

• Ideas for creating random numbers are offered by Eastlake [RFC1750]

• Encrypt the session ID if you expose it to the user. For instance session ID can be stored in a cookie in encrypted format.

Weaknesses it exploits

• CWE-6 J2EE Misconfiguration: Insufficient Session-ID Length
• CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
• CWE-285 Improper Authorization
• CWE-290 Authentication Bypass by Spoofing
• CWE-330 Use of Insufficiently Random Values
• CWE-331 Insufficient Entropy
• CWE-346 Origin Validation Error
• CWE-384 Session Fixation
• CWE-488 Exposure of Data Element to Wrong Session
• CWE-539 Use of Persistent Cookies Containing Sensitive Information
• CWE-693 Protection Mechanism Failure

Recent CVEs with these weaknesses

1. 8.1CVE-2026-1081872026-11-10

   Origin Validation Error in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.

2. –CVE-2026-978882026-11-10

   The embedded HTTP server does not clear the security identity established during a request before its worker thread handles the next request. A remote unauthenticated attacker can have their request processed with the identity of a previou…

3. –CVE-2026-978902026-11-10

   The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authent…

4. –CVE-2026-1112422026-11-10

   When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote a…

5. –CVE-2026-1112452026-11-10

   After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request completes when web services are served by the standalone OpenEJB HTTP server. A remote unauthenticate…

6. 4.3CVE-2026-1249442026-11-10

   Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160.

7. 4.3CVE-2026-1249412026-11-10

   Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

8. 4.3CVE-2026-1249302026-11-10

   Information disclosure in the Address Bar component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

The newest records naming one of them. Each weakness's page lists them all.

Related attack patterns

Part of

• CAPEC-196 Session Credential Falsification through Forging

Examples

MITRE's words, unchanged: CAPEC-59 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.