Authenticated session hijack via poisoned session cookie

Session fixation in ZoneMinder through 1.36.12 allows remote authenticated users to poison a session cookie for the next logged-in user. The flaw accepts an attacker-controlled session cookie and reuses it when a subsequent user logs in, binding that user's account to the attacker-known session. The attacker needs network access and a valid low-privilege account plus victim login; resulting access can expose or alter the victim's session scope.