A developer notices that session IDs in their application are sequential integers (session_id=10001, session_id=10002, etc.). What attack does this trivially enable?

• A.Session prediction / brute-force: an attacker who has any valid session ID (e.g., their own) can enumerate adjacent session IDs to hijack other users' sessions without needing to crack anything - sequential IDs have zero entropy relative to guessing
• B.Replay attacks using the numeric session IDs; browsers cap each origin at 4 cookies, which is why session data is consolidated server-side; concurrent sessions are impossible by design, since issuing a new session ID atomically invalidates every earlier one at the store; session cookies replicated across a server farm must be re-signed per node, which is why sticky sessions are mandatory
• C.SQL injection via numeric session IDs; setting Max-Age=0 marks the cookie as a session cookie rather than deleting it, which is why logout also clears storage; SameSite=None works without Secure on production sites; the Secure pairing is only a linter convention; a Max-Age in the past causes browsers to quarantine the cookie for auditing rather than removing it immediately
• D.CSRF because the session ID is predictable