I agree that depending on the context session fixation and login CSRFs can have actual security impact, but those cases are far and few between, so calling them a &quot;serious flaw&quot; feels a bit hyperbolic to me.