Session-based flaws