Live › vulnerability › CVE-2026-119416
CakePHP's HTTP Client cookie handling matches cookie domains by suffix without anchoring, so a server on a lookalike host can receive or plant cookies meant for another domain. An attacker can steal session cookies or inject cookies into a shared client cookie jar.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Applications that use CakePHP's HTTP Client to call other hosts while keeping cookies, especially where the client sends cookies to hosts an attacker can influence. Apps that only serve requests and never make outbound HTTP calls with cookies are less exposed. The sources do not say which specific configurations are vulnerable.
No product ranges from the sources yet.
composer.lock or with bin/cake --version; affected releases are those through 5.4.3.Cake\Http\Client and shares a cookie jar across requests to multiple hosts.5.4.3; the exact fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching. Attackers controlling a host such as one ending in a victim domain suffix, or sending Set-Cookie Domain values for unrelated hosts, can steal session cookies or inject cookies into shared client cookie jars.
This page as .md · .json · in your agent: get_signal("CVE-2026-119416")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.