We recently went through a security assessment and one of the 'findings' noted that DNN allows multiple active sessions to be open for the same user account. It is my understanding that DNN does not have a built-in setting to prevent this and would require source code modification. Is this a correct assumption?
yes, that is correct - and due to HTML being a stateless protocol, it is really hard to implement the limit without blocking users from re-entering the site after closing their Webbrowser.