Cookie Injection Vulnerability in JetBrains Ktor
CVE-2026-123319

3.7LOW

Key Information:

Vendor

Jetbrains
Status
Ktor
Vendor
CVE Published:
6 November 2026

What is CVE-2026-123319?

A vulnerability exists in JetBrains Ktor versions prior to 3.6.1 due to improper validation of the Domain attribute in client cookie storage. This allows for potential cookie injection attacks, where an attacker could exploit the issue to insert malicious cookies, posing a risk to the security of user sessions and sensitive data. It’s critical for developers using Ktor to upgrade to the latest versions to mitigate these risks and ensure the integrity of their applications.

Affected Version(s)

Ktor 0 < 3.6.1

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.