CAPEC-60
Reusing Session IDs (aka Session Replay)
This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-60: Reusing Session IDs (aka Session Replay): how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/60.html and https://cve.bz/cve/capec/60?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
How the attack unfolds
Explore
The attacker looks for a way in.
The attacker interacts with the target host and finds that session IDs are used to authenticate users.
The attacker steals a session ID from a valid user.
Exploit
They carry out the attack.
The attacker tries to use the stolen session ID to gain access to the system with the privileges of the session ID's original owner.
Prerequisites
The target host uses session IDs to keep track of the users.
Session IDs are used to control access to resources.
The session IDs used by the target host are not well protected from session theft.
Skills required
- Low skill
If an attacker can steal a valid session ID, they can then try to be authenticated with that stolen session ID.
- Medium skill
More sophisticated attack can be used to hijack a valid session from a user and spoof a legitimate user by reusing their valid session ID.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Gain Privileges | Confidentiality, Access Control, Authorization |
Mitigations
Always invalidate a session ID after the user logout.
Setup a session time out for the session IDs.
Protect the communication between the client and server. For instance it is best practice to use SSL to mitigate adversary in the middle attacks (CAPEC-94).
Do not code send session ID with GET method, otherwise the session ID will be copied to the URL. In general avoid writing session IDs in the URLs. URLs can get logged in log files, which are vulnerable to an attacker.
Encrypt the session data associated with the session ID.
Use multifactor authentication.
Weaknesses it exploits
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- CWE-285 Improper Authorization
- CWE-290 Authentication Bypass by Spoofing
- CWE-294 Authentication Bypass by Capture-replay
- CWE-346 Origin Validation Error
- CWE-384 Session Fixation
- CWE-488 Exposure of Data Element to Wrong Session
- CWE-539 Use of Persistent Cookies Containing Sensitive Information
- CWE-664 Improper Control of a Resource Through its Lifetime
- CWE-732 Incorrect Permission Assignment for Critical Resource
Recent CVEs with these weaknesses
- 8.1CVE-2026-108187
Origin Validation Error in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.
- –CVE-2026-97888
The embedded HTTP server does not clear the security identity established during a request before its worker thread handles the next request. A remote unauthenticated attacker can have their request processed with the identity of a previou…
- –CVE-2026-97890
The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authent…
- –CVE-2026-111242
When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote a…
- –CVE-2026-111245
After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request completes when web services are served by the standalone OpenEJB HTTP server. A remote unauthenticate…
- 4.3CVE-2026-124944
Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160.
- 4.3CVE-2026-124941
Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
- 4.3CVE-2026-124930
Information disclosure in the Address Bar component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
- Part of
- CAPEC-593 Session Hijacking
Examples
OpenSSL and SSLeay allow remote attackers to reuse SSL sessions and bypass access controls. See also: CVE-199…
OpenSSL and SSLeay allow remote attackers to reuse SSL sessions and bypass access controls. See also: CVE-1999-0428
Merak Mail IceWarp Web Mail uses a static identifier as a user session ID that does not change across session…
Merak Mail IceWarp Web Mail uses a static identifier as a user session ID that does not change across sessions, which could allow remote attackers with access to the ID to gain privileges as that user, e.g. by extracting the ID from the user's answer or forward URLs. See also: CVE-2002-0258
MITRE's words, unchanged: CAPEC-60 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.