Look for:
GET /login setting a Set-Cookie: session=abc before authentication.
Test by grabbing that pre-auth session ID, logging in with it, and checking if the same session ID remains valid after login or if logging in from another browser with a forced session cookie grants access.
If the session ID is not rotated post-authentication, it may indicate Session Fixation, enabling account takeover when an attacker plants a known session ID on a victim.
For more tips join our Telegram channel: https://t.me/bugbountyusa