Language: PHP
Label: vulnerable
CWE: CWE-613 \u2014 Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Code:
	public function testUserSession2()
	{
		$session = (new AutoSession($this->app->root('sessions')))->createManually();
		$session->set('kirby.userId', 'homer');

		$user = $this->auth->user($session);
		$this->assertSame('homer@simpsons.com', $user->email());
		$this->assertSame([
			'challenge' => null,
			'email'     => 'homer@simpsons.com',
			'status'    => 'active'
		], $this->auth->status()->toArray());
	}