Posted by Ron E on Aug 18The application does not issue a new session identifier (JSESSIONID) after successful authentication. An attacker who can set or predict a victim’s session ID prior to login may hijack the victim’s authenticated session once they log in, resulting in full account takeover. POST /webui HTTP/2 Host: Cookie: JSESSIONID=node01*.node0;