Session Fixation

github.com/ory/hydra is vulnerable to session fixation attacks. A malicious user can pass a consent uri missing a CSRF token to the user and log in afterwards as that user through a callback url...