Certified Ethical Hacker (CEH) Practice Question

The server should invalidate any pre-login session identifier and generate a fresh, unpredictable value once the user is authenticated. Re-using the unauthenticated PHPSESSID after successful login lets an attacker pre-set or capture that identifier and later force or trick the victim to use it, resulting in the attacker controlling the victim's authenticated session. This weakness is known as session fixation. The other options describe different flaws: CSRF exploits trust in an existing session but does not rely on reusing a pre-login token; insecure direct object references involve insufficient authorization checks on resources; weak session entropy permits brute-force guessing of many IDs rather than accepting an attacker-supplied one.