Session Poisoning
Named by 3 kept items in this workspace.
2 items name it under classification.key entities and 1 under techniques.
Search every workspace for Session Poisoning. It matches the name as written, so it can find other things that share it.
The items that name it 3
Missing Session Ownership Validation allows an attacker with a stolen session ID to send POST to /messages/<session-id> with a tool call; server accepts it without validating ownership, executes the tool, and sends the response to the victim's SSE stream, so the victim receives attacker-injected too
All techniques in this workspace.