CVE-2026-55617: Custom Session Recreate Without Deletecve-2026-55617-custom-session-recreate-without-delete
Recreating a session token without explicitly deleting the previous session from the token store can result in insufficient session expiration. Orphaned session identifiers may remain fully privileged, allowing session hijacking. Ensure the old session is deleted (e.g., typically via `$TOKEN.del()`) before generating and assigning a new one.
