RIPE NCC session fixation: poaching logins with an Atlas probe

RIPE NCC&rsquo;s single sign-on did not rotate session tokens on login, leaving 12000 Atlas probe hosts in a position to compromise other RIPE NCC users&rsquo; logins. A single link click planted a session token in a target&rsquo;s browser. When that target next logged in to a RIPE NCC service, possibly much later, the attacker could access their account. An XSS variant did the same regardless of…