Authenticated session state is the live proof that a user has already completed login and is still recognized by a service as signed in. In web apps, this state is usually carried by cookies, tokens, or other browser-held artifacts that let the server trust subsequent requests without asking for the password again.
This matters because stealing session state can be as powerful as stealing credentials. In real attacks, infostealer malware on an endpoint may copy browser session data and replay it from another device, letting an attacker act as the victim, access SaaS accounts, and consume resources or data. Defenses include revoking active sessions, forcing reauthentication, protecting endpoints from malware, and monitoring for unusual logins or impossible travel. Session state should be treated as a sensitive credential, not just a convenience feature.