Language: Java
Label: vulnerable
CWE: NVD-CWE-noinfo \u2014 

Code:
    private void createSession( final AuthenticationInfo authInfo )
    {
        final Session session = this.context.get().getLocalScope().getSession();
        if ( session != null )
        {
            session.setAttribute( authInfo );
        }

        if ( this.sessionTimeout != null )
        {
            setSessionTimeout();
        }
    }