When contributed modules such as Workflow NG terminate the current request during a login event, user module is not able to regenerate the user's session.
Credit:
The information has been provided by Peter Wolanin.
When contributed modules such as Workflow NG terminate the current request during a login event, user module is not able to regenerate the user's session. This may lead to a session fixation attack, when a malicious user is able to control another users' initial session ID. As the session is not regenerated, the malicious user may use the 'fixed' session ID after the victim authenticates and will have the same access. This issue affects both Drupal 5 and Drupal 6.
Vendor Status:
Drupal issued an update for this vulnerability
