Session Stored Lockout Counter Abuse

Variants:
Direct 

Vector Operation Method:
Attackers performing credential brute force attacks on specific accounts can replace session identifiers after a number of attempts which is smaller than the number triggering the account lockout, due to a programming flaw that stores the login failure counters in a non-persistent location.