$150 bounty for Session Fixation Vulnerability | Broken Authentication and Session Management
Steps to Reproduce:
1) create an account and login
2) Click on my account page and refresh the page and capture the cookie and logout.
3) open up any other browser or incognito window and open this url https://www.example.com/profile/ and capture the request.
4) now replace the cookie you have captured in step 2
5) and boom the attacker have full access to that account.
~even after the user logout from main application, an attacker can still use that same cookie to get the details again.~ which is reveling sensitive details and attacker can also edit the details.