Users of hummingbird-auth should update to version 2.3.0 now. It includes a fix for the following security advisory
Attacker-controlled session id accepted during session creation leads to session fixation
When saving sessions SessionMiddleware will check for the SESSION_ID cookie in the request and trust the value provided regardless of whether they are updating an existing session or creating a new session. If an attacker can get a victim's browser to carry an attacker defined SESSION_ID cookie before the victim authenticates (e.g. via a crafted link, sub-domain cookie injection, network-adjacent cookie planting, or any other cookie-setting primitive) they can subsequently use their pre-defined SESSION_IDto access the victim's fully authenticated session without seeing the Set-Cookie header or knowing the victim's credentials.
Unfortunately this advisory does not have a CVE IDs yet as GitHub has a massive backlog of security advisories to review.
Thank you to @EQSTLab for reporting this issue.