Florian Weimer reported a session fixation flaw in Cumin's login procedure.  Because Cumin does not reset the session cookie after authentication, an attacker could obtain a session cookie from the server, use loopholes in the browser security model to set the cookie in the victim's browser, and use the victim's session after the victim has logged into the site.