Wondering about the need of user session in P-40

[patatoid]

Hi,

Thank you for this great work on the security considerations of OID4VC.

I was reading P-40 and could not understand the need for user sessions in same-device flows and if the lack of it in cross-device ones would be a security leak.

In the hope of a reply.