Successive session identifiers issued by the application are numeric and increase in small steps. Such identifiers are generated from a counter or a clock, so an attacker who obtains one can calculate the identifiers of the sessions that were created before and after it, and take over those sessions without any further interaction.

1. Replace the generator with the session mechanism of the framework or with a cryptographically secure random generator that produces at least 128 bits.

2. Never derive identifiers from counters, timestamps, user names or other guessable values.

3. Invalidate all sessions that were issued by the old generator.

• CWE-330: Use of Insufficiently Random Values
• OWASP Session Management Cheat Sheet