In the context of a web application, a user connects to this application and a session id cookie is set to authenticate the user for next requests. As the cookie is actually present before submitting the login form, there is no new value generated on login success but instead, the value present in the cookie is taken as it is. So a normal user can choose to set the value to ‘0000000000000000000000000000’ for example.
Now I don’t know, but maybe there is a way for an attacker to set the cookie value of a victim before he/she logs in and once the login succeed, the value becomes valid and accepted for the server and then can be used by the attacker to enter the victim’s account.
So, is there a security risk in the fact that the value of the session id cookie is not necessarily chosen by the server?
EDIT: Some precisions regarding the first answers. I removed the tag "attack-prevention" because I just want to evaluate the risk of the scenario described as it is. I know HTTPS could resolve many security concerns but this is not exactly the question.