{"id":"CVE-2026-119416","kind":"vulnerability","aliases":["CVE-2026-119416"],"related":[],"title":"CakePHP: HTTP client cookie domain check lets rogue hosts steal cookies","description":"CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching. Attackers controlling a host such as one ending in a victim domain suffix, or sending Set-Cookie Domain values for unrelated hosts, can steal session cookies or inject cookies into shared client cookie jars.","summary":"CakePHP's HTTP Client cookie handling matches cookie domains by suffix without anchoring, so a server on a lookalike host can receive or plant cookies meant for another domain. An attacker can steal session cookies or inject cookies into a shared client cookie jar.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cakephp","http-client","package","php"],"not_affected_if":["no-cookie-jar","no-outbound-http-client"],"how_to_check":"- Check the CakePHP version in `composer.lock` or with `bin/cake --version`; affected releases are those through `5.4.3`.\n- Find code that uses `Cake\\Http\\Client` and shares a cookie jar across requests to multiple hosts.","fix":"- Move to a CakePHP release newer than `5.4.3`; the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-10-30T12:16:38+00:00","first_seen_at":"2026-10-30T12:30:23+00:00","triaged_at":"2026-10-30T12:32:43+00:00","updated_at":"2026-10-30T12:32:43+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T12:32:43Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a CakePHP release newer than `5.4.3`; the exact fixed version is unknown from the sources.","reach":"network","title":"CakePHP: HTTP client cookie domain check lets rogue hosts steal cookies","impact":"medium","summary":"CakePHP's HTTP Client cookie handling matches cookie domains by suffix without anchoring, so a server on a lookalike host can receive or plant cookies meant for another domain. An attacker can steal session cookies or inject cookies into a shared client cookie jar.","audience":"developers","category":"package","nicknames":[],"who_cares":["cakephp","php","http-client"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"session cookies stolen and cookies injected into shared jars","analyst_note":"Confirm the fixed CakePHP version and which HTTP Client cookie configurations are affected, using the vendor advisory.","how_to_check":"- Check the CakePHP version in `composer.lock` or with `bin/cake --version`; affected releases are those through `5.4.3`.\n- Find code that uses `Cake\\Http\\Client` and shares a cookie jar across requests to multiple hosts.","plain_action":"","needs_analyst":true,"not_affected_if":["no-outbound-http-client","no-cookie-jar"],"who_is_affected":"Applications that use CakePHP's HTTP Client to call other hosts while keeping cookies, especially where the client sends cookies to hosts an attacker can influence. Apps that only serve requests and never make outbound HTTP calls with cookies are less exposed. The sources do not say which specific configurations are vulnerable.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000727,"input_tokens":4168,"output_tokens":620,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119416':14A,17A '-2026':13A,16A '5.4.3':70C 'abus':93C 'allow':84C 'anchor':36B 'anoth':51B 'attack':54B,97C 'cakephp':1A,18B,24B,68C 'check':6A 'client':3A,21B,27B,65B,81C,129C 'contain':71C 'control':98C 'cooki':4A,11A,28B,31B,48B,58B,61B,66B,74C,91C,114C,123C,126C,130C 'cookiecollect':82C 'cve':12A,15A 'domain':5A,32B,52B,75C,108C,115C 'end':104C 'handl':29B 'host':9A,43B,100C,119C 'http':2A,20B,26B,80C 'http-client':19B 'improp':73C 'inject':60B,125C 'jar':67B,131C 'let':7A 'lookalik':42B 'malici':85C 'match':30B,96C 'meant':49B 'one':103C 'packag':22B 'php':23B 'plant':47B,90C 'receiv':45B,88C 'rogu':8A 'send':111C 'server':39B,86C 'session':57B,122C 'set':113C 'set-cooki':112C 'share':64B,128C 'steal':10A,56B,121C 'suffix':34B,95C,109C 'unanchor':94C 'unrel':118C 'valid':76C 'valu':116C 'victim':107C 'vulner':77C 'without':35B","nicknames":[],"mitigations":[],"who_affected":"Applications that use CakePHP's HTTP Client to call other hosts while keeping cookies, especially where the client sends cookies to hosts an attacker can influence. Apps that only serve requests and never make outbound HTTP calls with cookies are less exposed. The sources do not say which specific configurations are vulnerable.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T12:16:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119416","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119416","severity":null,"published_at":"2026-10-30T12:16:38+00:00","modified_at":"2026-10-30T12:16:38+00:00","first_seen_at":"2026-10-30T12:30:23+00:00","fetched_at":"2026-10-30T12:30:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}