Session hijacking is a security attack where an attacker takes over a valid session between a user and a server, allowing them to impersonate the user and gain unauthorized access to information or services. This is typically achieved by stealing or predicting a valid session token, exploiting vulnerabilities in session management mechanisms.