CVE-2024-52553: Session fixation vulnerability in Jenkins OpenId Connect Authentication Plugin

The vulnerability stems from missing session invalidation during login. In Jenkins authentication flows, the login completion handler (typically doFinishLogin in SecurityRealm implementations) is responsible for session management. The advisory specifically mentions session fixation through preserved sessions, indicating the login sequence doesn't properly cycle sessions. The OicSecurityRealm class would contain the authentication completion logic, and the absence of session.invalidate() calls before establishing new authentication credentials would leave previous sessions active. The high confidence comes from the direct match between the vulnerability description and standard session management practices in Jenkins plugins.