CVE-2026-119416
4.8 MEDIUMpublic exploit availablePublished 2026-10-30 · Updated 2026-10-30
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching. Attackers controlling a host such as one ending in a victim domain suffix, or sending Set-Cookie Domain values for unrelated hosts, can steal session cookies or inject cookies into shared client cookie jars.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-346
Public exploit & PoC references
- https://github.com/cakephp/cakephp
- https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Http/Cookie/CookieCollection.php#L315
- https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Http/Cookie/CookieCollection.php#L74
- https://github.com/cakephp/cakephp/commit/01753266738606bc0e48e61e44a6e252f11386f9
- https://github.com/cakephp/cakephp/commit/5d9d01a91f0e678d857a94115de12c3e02f3fbba
- https://github.com/cakephp/cakephp/commit/819b45cbcc5ba864568cb57f62e4fde650b41161
- https://github.com/cakephp/cakephp/commit/bbba5ed06d5cea7e78333b01e65557cff7a28306
- https://github.com/cakephp/cakephp/pull/19702
All references
- https://abraxaslabs.tech/research/cakephp-cookie-suffix
- https://github.com/cakephp/cakephp
- https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Http/Cookie/CookieCollection.php#L315
- https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Http/Cookie/CookieCollection.php#L74
- https://github.com/cakephp/cakephp/commit/01753266738606bc0e48e61e44a6e252f11386f9
- https://github.com/cakephp/cakephp/commit/5d9d01a91f0e678d857a94115de12c3e02f3fbba
- https://github.com/cakephp/cakephp/commit/819b45cbcc5ba864568cb57f62e4fde650b41161
- https://github.com/cakephp/cakephp/commit/bbba5ed06d5cea7e78333b01e65557cff7a28306
- https://github.com/cakephp/cakephp/pull/19702
- https://www.vulncheck.com/advisories/cakephp-through-5.4.3-cookie-leakage-via-http-client-cookiecollection-domain-matching
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-100598PoC
- HIGHCVE-2026-100642PoC
- HIGHCVE-2026-100646PoC
- HIGHCVE-2026-100803
- HIGHCVE-2026-100809
- HIGHCVE-2026-100816
- MEDIUMCVE-2026-100821
- HIGHCVE-2026-100830
Related by shared AI tags and CWE weakness class. Browse the full archive.