Session IDs are used to identify a user session. They are usually stored in cookies, URL parameters, or hidden form fields.
If a session ID can be guessed (not generated with a secure pseudo random generator, or with insufficient length …) an attacker may be able to
hijack another user’s session.
If an application allows users to specify their own session ID (for example via URL parameters or form fields), an attacker may be able to set a
known session ID for a victim user, and then hijack the victim’s session (session fixation attack).
