Silverstripe silverstripe/framework up to and including 4.10 allows Session Fixation.
silverstripe silverstripe 2.5.0
silverstripe silverstripe