Improper Cookie Domain Validation in CakePHP
CVE-2026-119416

6.3MEDIUM

Key Information:

Vendor

CakePHP

Status
CakePHP
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119416?

CakePHP versions up to 5.4.3 have a vulnerability that allows improper cookie domain validation in the Http Client's CookieCollection. This flaw enables attackers to exploit unanchored suffix matching, potentially allowing malicious servers to intercept session cookies or inject cookies into shared client cookie jars. By manipulating Set-Cookie Domain values or controlling a host that ends with a target domain suffix, attackers can stealthily receive and plant cookies, posing significant risks to user sessions.

Affected Version(s)

cakephp 0 <= 5.4.3

References

https://github.com/cakephp/cakephp/commit/01753266738606b...
patch
https://github.com/cakephp/cakephp/commit/5d9d01a91f0e678...
patch
https://github.com/cakephp/cakephp/commit/bbba5ed06d5cea7...
patch

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abraxas Labs
Mark Story
.