I assume you've set $g_cookie_path to a different value for each installation?

I thought that everything about multiple installation was managed by a single option.
Now I looked to the cookies options.
It was sufficient to modify $g_cookie_prefix parameter.

May be it is useful in the configuration file to add to the comments of $g_session_key that you must modify also $g_cookie_prefix.
Another possibility is to have the configuration get the $g_session_key value as $g_cookie_prefix defaults.
Something like:

    /**
     * --- cookie prefix ---------------
     * set this to a unique identifier.  No spaces.
     * @global string $g_cookie_prefix
     */
    $g_cookie_prefix                = $g_session_key;

So if the user change $g_session_key everything is working as expected, and the user still have the possibility to do more personalisation.

I don't see any need to allow MantisBT administrators to set the session key themselves. We should be able to just assign a random value to it based on the new $g_crypto_random_salt configuration option in MantisBT 1.3.x.

Removed $g_session_key - it is now derived from $g_crypto_master_salt.

Marking as 'acknowledged' not resolved/closed to track that change gets ported to master-2.0.x branch