SilverStripe up to and including 4.3.3 allows session fixation in the "change password" form.
silverstripe silverstripe