What vulnerability occurs when an attacker can impersonate a user due to weak or predictable session identifiers?

What vulnerability occurs when an attacker can impersonate a user due to weak or predictable session identifiers?

• A. Insecure Direct Object References
• B. Broken Authentication
• C. Access Control
• D. Missing Function Level Access Control

Answer: (B)

Weak or predictable session identifiers open the door to session hijacking: an attacker can guess or steal a valid session token and present it to the server to impersonate the authenticated user. This undermines the authentication mechanism itself, which is the essence of Broken Authentication. Other issues described by the other options involve accessing forbidden resources directly, or missing permission checks for actions, but they don’t center on impersonating a user through compromised session tokens. To prevent this, use strong, random session IDs, transmit them only over secure channels, mark cookies as Secure and HttpOnly, regenerate IDs after login, enforce reasonable session lifetimes, and monitor for unusual session activity.

Weak or predictable session identifiers open the door to session hijacking: an attacker can guess or steal a valid session token and present it to the server to impersonate the authenticated user. This undermines the authentication mechanism itself, which is the essence of Broken Authentication. Other issues described by the other options involve accessing forbidden resources directly, or missing permission checks for actions, but they don’t center on impersonating a user through compromised session tokens. To prevent this, use strong, random session IDs, transmit them only over secure channels, mark cookies as Secure and HttpOnly, regenerate IDs after login, enforce reasonable session lifetimes, and monitor for unusual session activity.