When developers are programming web application based solutions they rarely focus on how the user's session is managed. Failing to keep this in mind can lead developers to introduce session management vulnerabilities in their applications.
Session management vulnerabilities occur when developers fail to protect their users sensitive information such as user names, passwords, and session tokens.
Broken authentication vulnerabilities occur when developers fail to use authentication methods that have been adequately tested and rely on their own, often flawed, method for authenticating users.
These vulnerabilities are very hard for developers to identify on their own due to the far-reaching aspect of the code that handles session and authentication.