Session Fixation

@fastify/passport is vulnerable to Session Fixation. The vulnerability exists because the user validations do not properly perform in the logIn and logOut functions of SecureSessionManager.ts, which allows an attacker to hijack the victim’s session by tossing a valid sessionId cookie in the victim’s browser and waiting for the victim to log in on the website. Note that the vulnerability is only applicable if the app is using @fastify/session as the underlying session management mechanism.