A session secret is the value that keeps a logged-in session valid after authentication succeeds. In many systems it is a random token, session ID, or signed value stored in a cookie or header. After the user proves identity with a password or MFA, the application uses the session secret to recognize later requests without asking for credentials again.
Session secrets matter because whoever has them can often act as the authenticated user until the session expires or is revoked. In real attacks, stolen session cookies or token secrets let an intruder bypass login controls, even when the password is changed. Defenders protect these values with strong randomness, secure cookie flags, short lifetimes, server-side invalidation, and reauthentication for sensitive actions. Logging out, resetting credentials, or enabling MFA does not always end an active session unless the session secret is also revoked.