Session fixation
An attack where the attacker plants a known session ID on the victim, then uses it after the victim logs in.
In session fixation the attacker obtains a valid unauthenticated session ID and gets the victim's browser to use it (a link with the ID in the URL, a cookie set from a sibling subdomain). If the application keeps the same ID after login, the attacker's copy is now an authenticated session.
The fix is simple and mandatory: issue a new session ID on every privilege change (login, step-up, role switch) and invalidate the old one. Also never accept session IDs from URLs, and use the __Host- cookie prefix so subdomains cannot set the cookie.
It is a staple of session manager design questions alongside idle and absolute timeouts, revocation and concurrent session limits.