Language: PHP
Label: vulnerable
CWE: CWE-613 \u2014 Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Code:
	public function testUserSession1()
	{
		$session = $this->app->session();
		$session->set('kirby.userId', 'marge');

		$user = $this->auth->user();
		$this->assertSame('marge@simpsons.com', $user->email());

		$this->assertSame([
			'challenge' => null,
			'email'     => 'marge@simpsons.com',
			'status'    => 'active'
		], $this->auth->status()->toArray());

		// impersonation is not set
		$this->assertNull($this->auth->currentUserFromImpersonation());

		// value is cached
		$session->set('kirby.userId', 'homer');
		$user = $this->auth->user();
		$this->assertSame('marge@simpsons.com', $user->email());
		$this->assertSame([
			'challenge' => null,
			'email'     => 'marge@simpsons.com',
			'status'    => 'active'
		], $this->auth->status()->toArray());
	}