A session fixation web vulnerability has been discovered in the official PayPal Inc online service web application.