CVE-2026-119416
Received Received - Intake

Improper Cookie Domain Validation in CakePHP

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching. Attackers controlling a host such as one ending in a victim domain suffix, or sending Set-Cookie Domain values for unrelated hosts, can steal session cookies or inject cookies into shared client cookie jars.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119416
EUVD
EUVD-2026-113796

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cakephp cakephp 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-346 The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CakePHP through version 5.4.3 has an improper cookie domain validation issue in its Http Client CookieCollection. This flaw allows attackers controlling a server with a domain suffix matching a victim's domain to steal session cookies or inject malicious cookies into shared client cookie jars by exploiting unanchored suffix matching.

Detection Guidance

To detect this vulnerability, inspect CakePHP applications using versions up to 5.4.3 for improper cookie domain handling. Check if the Http Client CookieCollection uses unanchored suffix matching in domain validation. Review server logs for Set-Cookie headers with crafted Domain attributes. Test if cookies are shared across unrelated domains or subdomains.

Impact Analysis

If you use CakePHP 5.4.3 or earlier, attackers could steal your session cookies or plant malicious cookies on your system. This could lead to unauthorized account access, data theft, or session hijacking if you interact with domains vulnerable to this attack.

Compliance Impact

This vulnerability could lead to unauthorized data access or session hijacking, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using affected CakePHP versions may face compliance risks if user data is compromised.

Mitigation Strategies

Upgrade CakePHP to version 5.4.4 or later to address the improper cookie domain validation issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119416. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart