The session ID is only an MD5 hashcode at the end of the day. It has been demonstrated not so long ago that this algorithm has a collision rate several orders of magnitude greater than its theoretical limit.
Once you get sufficient users with enough login turnover, this problem can be difficult as the number of open sessions increases and with it the likelihood of collision.
More worrying is the fact that XOOPs itself uses MD5 hashcodes for various keys within its implementation.
Also, it is sometimes the case that in PHP, the session ID is passed on the URL if for some reason cookies aren't working and the page allows it (it will usually use an invisible form field in preference, if it can). If you ever see PHPSESSID=<32 character hex string> in your url, don't post it as a link ;-)
-- this post by the actual Karlos, accept no imitations!
