Node js session exploit with known secret

Question

I'm doing CTF challenge where I've successfully retrieved session cookie, can I somhow bruteforce or maybe predict next session cookie and login someone else or change my role.

Here is how thay generate session cookie:

app.use(session({
    resave: false, // leave this as false!!
    saveUninitialized: true,
    secret:'secret',
    store: new MongoStore({ mongooseConnection: mongoose.connection }),
    ttl: 14 * 24 * 60 * 60 // = 14 days. Default
}));

I know that roles and all that is stored on server, but there must be some vulnerability that I could exploit.

I would appreciate a guide in right direction.