Session forgery is the creation or manipulation of a session token so an attacker can impersonate a legitimate user or administrator. A session token may be a cookie, bearer token, or signed identifier that tells a server who is logged in. If that token can be guessed, forged, replayed, or altered without detection, the server may accept the attacker as trusted.
This matters because session controls often protect the most sensitive functions in a system: account management, configuration changes, data access, and administrative actions. In real attacks, session forgery can follow weak randomness, exposed signing secrets, poor token validation, or broken session lifetimes. Defenses include using cryptographically strong randomness, protecting signing keys, binding sessions to expected server checks, expiring tokens promptly, and invalidating them after privilege changes or logout. Even strong passwords and MFA can be bypassed if the session itself is no longer trustworthy.