---
id: "CVE-2026-119416"
kind: "vulnerability"
aliases: ["CVE-2026-119416"]
title: "CakePHP: HTTP client cookie domain check lets rogue hosts steal cookies"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cakephp", "http-client", "package", "php"]
not_affected_if: ["no-cookie-jar", "no-outbound-http-client"]
published_at: "2026-10-30T12:16:38+00:00"
first_seen_at: "2026-10-30T12:30:23+00:00"
updated_at: "2026-10-30T12:32:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119416", "first_seen_at": "2026-10-30T12:30:23+00:00"}]
---

# CakePHP: HTTP client cookie domain check lets rogue hosts steal cookies

CakePHP's HTTP Client cookie handling matches cookie domains by suffix without anchoring, so a server on a lookalike host can receive or plant cookies meant for another domain. An attacker can steal session cookies or inject cookies into a shared client cookie jar.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the CakePHP version in `composer.lock` or with `bin/cake --version`; affected releases are those through `5.4.3`.
- Find code that uses `Cake\Http\Client` and shares a cookie jar across requests to multiple hosts.

## Fix

- Move to a CakePHP release newer than `5.4.3`; the exact fixed version is unknown from the sources.

## Timeline

- 2026-10-30T12:30:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119416

## From the sources

CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching. Attackers controlling a host such as one ending in a victim domain suffix, or sending Set-Cookie Domain values for unrelated hosts, can steal session cookies or inject cookies into shared client cookie jars.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_