Weaknesses in confirming identity or managing sessions that let attackers impersonate legitimate users.