User Impersonation via Session Puzzling

Variants:
Direct 

Also Known As:
Session Variable Overloading, Session Poisoning

Vector Operation Method:
Malicious users can abuse hardcoded session identities or multiple components relying on identical identity session attributes to impersonate specific users in various sections of the application. Logical session puzzling attacks make use of forced browsing in customized sequences, hardcoded default session attributes, and in many cases, session poisoning.