So our first set of Session Management vulnerabilities relates to keeping the session identifier secret: Failure to use a cryptographically strong random value as the session identifier. If a session id value can be predicted, it need not be exposed for an attacker to hijack a session.