I have identified a session fixation vulnerability, below is the steps to reproduce:

Step 1: Browse the application https://mail.rainloop.net/ in any browser and intercept the request over proxy.
Step 2: Now observe the session cookie "rlsession=bdecad79956032d7c64489ad2962a593"
Step 3: Now login into the application and again intercept the request of an authenticated page.
Step 4: Now again observe the cookie "rlsession=bdecad79956032d7c64489ad2962a593"
Step 5: The session cookie is same prior and post authentication which makes the application vulnerable to session fixation.

Reference Link:
https://owasp.org/www-community/attacks/Session_fixation

Mitigation/Patch
If you assign a new session when someone logs in, this flaw should be fixed.