In JetBrains Ktor prior to 1.5.0, a birthday attack on SessionStorage key was possible.
jetbrains ktor