Session Hijacking.

What Is Session Hijacking?

OWASP says session hijacking exploits the web session control mechanism. That mechanism is normally protected by a session token. A web server sends this token to the browser after the user logs in. The browser sends it back so the server can tell which user is making each request. If an attacker compromises the token, OWASP says they can use a valid session token to gain unauthorized access to the web server.

How Does Session Hijacking Work?

OWASP lists several ways a token can be compromised:

• Predictable session token generation.
• Session sniffing, which means intercepting network traffic.
• Client-side attacks such as cross-site scripting or malicious code in the browser.
• Man-in-the-middle or man-in-the-browser attacks.

MITRE covers the theft side under stealing web session cookies. It says an adversary may steal a web application or service session cookie and use it to gain access as an authenticated user without needing credentials. MITRE adds that cookies can be taken from disk, browser memory or network traffic. Cookie settings such as Secure and HttpOnly are covered on our session cookie page.

Why Does MFA Not Stop a Stolen Session?

A stolen session token can let an attacker skip the login step. MITRE says the attacker does not need the user’s credentials, so a strong password alone may not protect an account once its session is taken. MITRE also says session cookies can be used to bypass some multi-factor authentication protocols, so MFA alone may not stop this. Our post on how cookies give away a session despite MFA explains the trend. A November 2026 example is covered in our Google Calendar session hijack case.

How Can Users and Teams Reduce Cookie Theft?

MITRE lists these mitigations for cookie theft:

• Use hardware-based tokens that include the login domain, and limit logins to trusted enrolled devices.
• Delete cookies regularly and keep how long they stay valid short.
• Teach users to spot phishing domains and to avoid running untrusted JavaScript.
• Restrict or block web content that could be used to extract session cookies, and keep browsers and related software updated.

What Signs Point to a Stolen Session?

MITRE points to suspicious access to browser cookie storage and unusual reads of browser process memory. It also advises monitoring logins for stolen cookie use, such as unusual travel patterns or anomalous behavior.

What Should You Do When a Session Looks Stolen?

MITRE’s detection notes for T1550.004 describe cookie reuse from a new place or client. Microsoft’s guide to revoking user access covers compromised accounts. The steps below follow both and use Microsoft Entra ID as the example.

Is a Hijacked Session the Same as a Taken-Over Account?

Not exactly. Session hijacking is one method, and it works through the session token. Account takeover is the wider outcome, where an attacker controls someone else’s account by any route, such as a password.

One route to a stolen session is interception in a man in the middle attack.

A token does not have to be a cookie. The Apache OFBiz flaw CVE-2026-82907 lets a captured externalLoginKey act as a complete, cookie-free session for the user it was issued to.

Related Pages in the Knowledge Hub

• Session cookies
• Adversary-in-the-middle
• Multi-factor authentication
• Valid Accounts
• Phishing 101
• MFA fatigue

Sources

• OWASP: OWASP defines session hijacking and lists ways a session token can be compromised.
• MITRE ATT&CK: MITRE describes stealing web session cookies to act as an authenticated user, with mitigations and detection ideas.
• MITRE ATT&CK: Detection analytics for stolen web session cookie reuse.
• Microsoft: Microsoft explains how to disable the account, revoke sessions and reset the password after a compromise.