Language: PHP
Label: vulnerable
CWE: CWE-613 \u2014 Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Code:
	public function currentUserFromSession($session = null)
	{
		$session = $this->session($session);

		$id = $session->data()->get('kirby.userId');

		if (is_string($id) !== true) {
			return null;
		}

		if ($user = $this->kirby->users()->find($id)) {
			// in case the session needs to be updated, do it now
			// for better performance
			$session->commit();
			return $user;
		}

		return null;
	}