Session fixation

Tricking a victim into using a session id the attacker already knows, then waiting for them to log in on it; fixed by regenerating the id at login.