Improper Access Control

Property	Value
Language
Severity
CWE	CWE-284: Improper Access Control
OWASP	A01:2021 - Broken Access Control
Confidence Level	Medium
Impact Level	Medium
Likelihood Level	Medium

Description

The session variable key is being set using untrusted user input, allowing attackers to control which session variables are modified or created. This breaks the expectation that only the application sets session data.

Impact

An attacker could overwrite or inject arbitrary session values, potentially gaining unauthorized access, escalating privileges, or tampering with user data. This can lead to broken access control, account takeover, or other serious security breaches.