An admin session is the authenticated browser state created when an administrator logs in to a site. It is usually maintained with cookies or tokens, and it grants the browser access to privileged functions such as changing settings, approving content, managing users, or installing plugins. Because the session already carries trust, anything that runs inside it can act with administrator-level authority until the session expires or is revoked.
This matters in cyber security because many attacks target the admin session instead of the password. If malicious script reaches an administrator’s browser through stored XSS or another client-side flaw, it may be able to make privileged requests as the logged-in user. Defenders protect admin sessions with strong authentication, short lifetimes, secure cookie settings, CSRF defenses, and careful input sanitization so untrusted content cannot influence privileged browser activity.