CWE-1275
AllowedSensitive Cookie with Improper SameSite Attribute
Abstraction: Variant · Status: Incomplete
The SameSite attribute for sensitive cookies is not set, or an insecure value is used.
43 vulnerabilities reference this CWE, most recent first.
GHSA-53CV-4FRM-9P27
Vulnerability from github – Published: 2026-08-27 06:31 – Updated: 2026-08-27 18:32A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19
{
"affected": [],
"aliases": [
"CVE-2026-47889"
],
"database_specific": {
"cwe_ids": [
"CWE-1275"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-27T06:17:19Z",
"severity": "HIGH"
},
"details": "A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19",
"id": "GHSA-53cv-4frm-9p27",
"modified": "2026-08-27T18:32:10Z",
"published": "2026-08-27T06:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47889"
},
{
"type": "WEB",
"url": "https://spring.io/security/cve-2026-47889"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5R8W-HMFJ-P69P
Vulnerability from github – Published: 2024-10-22 18:32 – Updated: 2024-10-22 18:32IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute.
{
"affected": [],
"aliases": [
"CVE-2024-43173"
],
"database_specific": {
"cwe_ids": [
"CWE-1275"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-22T15:15:06Z",
"severity": "LOW"
},
"details": "IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute.",
"id": "GHSA-5r8w-hmfj-p69p",
"modified": "2024-10-22T18:32:11Z",
"published": "2024-10-22T18:32:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43173"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7173596"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9F25-WFQC-782V
Vulnerability from github – Published: 2025-03-10 12:30 – Updated: 2025-03-24 15:30A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. A request to an OTRS endpoint from a possible malicious web site, would send the authentication cookie, performing an unwanted read operation.
This issue affects:
- OTRS 7.0.X
- OTRS 8.0.X
- OTRS 2023.X
- OTRS 2024.X
- OTRS 2025.x
{
"affected": [],
"aliases": [
"CVE-2025-24387"
],
"database_specific": {
"cwe_ids": [
"CWE-1275",
"CWE-352"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-10T10:15:14Z",
"severity": "MODERATE"
},
"details": "A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive \ncookie settings in HTTPS sessions. A request to an OTRS endpoint from a possible malicious web site, would send the authentication cookie, performing an unwanted read operation.\n\u00a0\n\nThis issue affects:\n\n * OTRS 7.0.X\n * OTRS 8.0.X\n * OTRS 2023.X\n * OTRS 2024.X\n * OTRS 2025.x",
"id": "GHSA-9f25-wfqc-782v",
"modified": "2025-03-24T15:30:38Z",
"published": "2025-03-10T12:30:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24387"
},
{
"type": "WEB",
"url": "https://otrs.com/release-notes/otrs-security-advisory-2025-05"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-C6MV-WGP4-CGJ2
Vulnerability from github – Published: 2025-05-05 21:31 – Updated: 2025-05-05 21:31HCL BigFix Compliance is affected by an improper or missing SameSite attribute. This can lead to Cross-Site Request Forgery (CSRF) attacks, where a malicious site could trick a user's browser into making unintended requests using authenticated sessions.
{
"affected": [],
"aliases": [
"CVE-2024-42212"
],
"database_specific": {
"cwe_ids": [
"CWE-1275"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-05T19:15:55Z",
"severity": "MODERATE"
},
"details": "HCL BigFix Compliance is affected by an improper or missing SameSite attribute. This can lead to Cross-Site Request Forgery (CSRF) attacks, where a malicious site could trick a user\u0027s browser into making unintended requests using authenticated sessions.",
"id": "GHSA-c6mv-wgp4-cgj2",
"modified": "2025-05-05T21:31:28Z",
"published": "2025-05-05T21:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42212"
},
{
"type": "WEB",
"url": "https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0120961"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CV8H-R7R5-VWJ9
Vulnerability from github – Published: 2025-12-19 21:30 – Updated: 2026-02-20 18:25Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. Attackers can trick victims into executing a crafted PHP script that captures and writes session cookie information to a file, enabling potential session hijacking.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "kimai/kimai"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.30.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-53957"
],
"database_specific": {
"cwe_ids": [
"CWE-1275"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-20T18:25:02Z",
"nvd_published_at": "2025-12-19T21:15:52Z",
"severity": "HIGH"
},
"details": "Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. Attackers can trick victims into executing a crafted PHP script that captures and writes session cookie information to a file, enabling potential session hijacking.",
"id": "GHSA-cv8h-r7r5-vwj9",
"modified": "2026-02-20T18:25:02Z",
"published": "2025-12-19T21:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53957"
},
{
"type": "PACKAGE",
"url": "https://github.com/kimai/kimai"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/51278"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/kimai-samesite-cookie-vulnerability-session-hijacking"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Kimai contains a SameSite cookie vulnerability"
}
GHSA-FM3F-CH8H-QW8Q
Vulnerability from github – Published: 2026-08-31 20:30 – Updated: 2026-08-31 20:30Summary
The built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the state-based CSRF protection under default usage.
Details
The state check treated two absent values as a match, so a callback that omits state — and for which no state was ever stored — was allowed to redeem the authorization code. Hono's csrf() middleware does not help: it only inspects form-style requests, while the OAuth callback is a top-level GET navigation it treats as safe.
This affects the google, github, facebook, discord, twitch, linkedin, and msentra providers. The x (Twitter) provider is not exploitable due to its PKCE binding.
Impact
An attacker can make a victim's browser complete an OAuth callback that binds the attacker's identity instead of the victim's, leading to login CSRF (the victim silently acts inside the attacker's account) or forced account linking (the attacker's identity is linked to the victim's account, enabling later sign-in as the victim). Affects applications using an affected provider on @hono/oauth-providers 0.8.5 or earlier.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@hono/oauth-providers"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-81888"
],
"database_specific": {
"cwe_ids": [
"CWE-1275",
"CWE-352"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-31T20:30:50Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\nThe built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the `state`-based CSRF protection under default usage.\n\n### Details\n\nThe `state` check treated two absent values as a match, so a callback that omits `state` \u2014 and for which no `state` was ever stored \u2014 was allowed to redeem the authorization code. Hono\u0027s `csrf()` middleware does not help: it only inspects form-style requests, while the OAuth callback is a top-level `GET` navigation it treats as safe.\n\nThis affects the `google`, `github`, `facebook`, `discord`, `twitch`, `linkedin`, and `msentra` providers. The `x` (Twitter) provider is not exploitable due to its PKCE binding.\n\n### Impact\n\nAn attacker can make a victim\u0027s browser complete an OAuth callback that binds the attacker\u0027s identity instead of the victim\u0027s, leading to login CSRF (the victim silently acts inside the attacker\u0027s account) or forced account linking (the attacker\u0027s identity is linked to the victim\u0027s account, enabling later sign-in as the victim). Affects applications using an affected provider on `@hono/oauth-providers` `0.8.5` or earlier.",
"id": "GHSA-fm3f-ch8h-qw8q",
"modified": "2026-08-31T20:30:50Z",
"published": "2026-08-31T20:30:50Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/honojs/middleware/security/advisories/GHSA-fm3f-ch8h-qw8q"
},
{
"type": "WEB",
"url": "https://github.com/honojs/middleware/pull/2040"
},
{
"type": "WEB",
"url": "https://github.com/honojs/middleware/commit/b37765f40b7bddb1d8fce39573b085222dea58c1"
},
{
"type": "PACKAGE",
"url": "https://github.com/honojs/middleware"
},
{
"type": "WEB",
"url": "https://github.com/honojs/middleware/releases/tag/%40hono%2Foauth-providers%400.8.6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking"
}
GHSA-FPMH-VX4H-XC33
Vulnerability from github – Published: 2026-08-14 19:25 – Updated: 2026-08-14 19:25Summary
Description
An Insecure Default Initialization of Resource (CWE-1188) issue in the OpenAM default configuration ships the iPlanetDirectoryPro SSO cookie with HttpOnly=false. Also, the iPlanetDirectoryPro SSO cookie is used as a CSRF token in OAuth/OIDC flows. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.
Impact
A single click on an attacker link may yield full SSO session theft of any authenticated console user when chained with any other same-origin XSS in the OpenAM origin. The missing SameSite default also widens the CSRF surface. Also, because the consent flow reuses the SSO cookie as its CSRF token, any XSS in the OpenAM origin both steals the session and completes attacker-driven OAuth consent grants in one step.
Patch
This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.openidentityplatform.openam:openam-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "16.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-53660"
],
"database_specific": {
"cwe_ids": [
"CWE-1004",
"CWE-1188",
"CWE-1275"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-14T19:25:57Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Summary\n\n**Description**\nAn Insecure Default Initialization of Resource (CWE-1188) issue in the OpenAM default configuration ships the `iPlanetDirectoryPro` SSO cookie with `HttpOnly=false`. Also, the `iPlanetDirectoryPro` SSO cookie is used as a CSRF token in OAuth/OIDC flows. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.\n\n## Impact\nA single click on an attacker link may yield full SSO session theft of any authenticated console user when chained with any other same-origin XSS in the OpenAM origin. The missing `SameSite` default also widens the CSRF surface. Also, because the consent flow reuses the SSO cookie as its CSRF token, any XSS in the OpenAM origin both steals the session and completes attacker-driven OAuth consent grants in one step.\n\n## Patch\nThis has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.",
"id": "GHSA-fpmh-vx4h-xc33",
"modified": "2026-08-14T19:25:57Z",
"published": "2026-08-14T19:25:57Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-fpmh-vx4h-xc33"
},
{
"type": "PACKAGE",
"url": "https://github.com/OpenIdentityPlatform/OpenAM"
},
{
"type": "WEB",
"url": "https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenAM Insecure SSO Cookie Initialization"
}
GHSA-FV45-RWVX-GXXG
Vulnerability from github – Published: 2026-02-03 21:31 – Updated: 2026-02-03 21:31HCL AION is affected by a Cookie with Insecure, Improper, or Missing SameSite vulnerability. This can allow cookies to be sent in cross-site requests, potentially increasing exposure to cross-site request forgery and related security risks. This issue affects AION: 2.0.
{
"affected": [],
"aliases": [
"CVE-2025-52628"
],
"database_specific": {
"cwe_ids": [
"CWE-1275"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-03T19:16:12Z",
"severity": "MODERATE"
},
"details": "HCL AION is affected by a Cookie with Insecure, Improper, or Missing SameSite vulnerability. This can allow cookies to be sent in cross-site requests, potentially increasing exposure to cross-site request forgery and related security risks. This issue affects AION: 2.0.",
"id": "GHSA-fv45-rwvx-gxxg",
"modified": "2026-02-03T21:31:50Z",
"published": "2026-02-03T21:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52628"
},
{
"type": "WEB",
"url": "https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0127972"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-GQQ5-V4CW-9926
Vulnerability from github – Published: 2023-07-06 03:30 – Updated: 2024-04-04 05:25Improper configuration in Samsung Internet prior to version 21.0.0.41 allows attacker to bypass SameSite Cookie.
{
"affected": [],
"aliases": [
"CVE-2023-30674"
],
"database_specific": {
"cwe_ids": [
"CWE-1275"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-06T03:15:12Z",
"severity": "MODERATE"
},
"details": "Improper configuration in Samsung Internet prior to version 21.0.0.41 allows attacker to bypass SameSite Cookie.",
"id": "GHSA-gqq5-v4cw-9926",
"modified": "2024-04-04T05:25:46Z",
"published": "2023-07-06T03:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30674"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2023\u0026month=07"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HR59-Q2GM-7HRJ
Vulnerability from github – Published: 2024-07-09 15:30 – Updated: 2024-07-16 18:31A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This vulnerability affects Firefox < 128.
{
"affected": [],
"aliases": [
"CVE-2024-6611"
],
"database_specific": {
"cwe_ids": [
"CWE-1275"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-09T15:15:13Z",
"severity": "CRITICAL"
},
"details": "A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This vulnerability affects Firefox \u003c 128.",
"id": "GHSA-hr59-q2gm-7hrj",
"modified": "2024-07-16T18:31:42Z",
"published": "2024-07-09T15:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6611"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1844827"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2024-29"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2024-32"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Set the SameSite attribute of a sensitive cookie to 'Lax' or 'Strict'. This instructs the browser to apply this cookie only to same-domain requests, which provides a good Defense in Depth against CSRF attacks. When the 'Lax' value is in use, cookies are also sent for top-level cross-domain navigation via HTTP GET, HEAD, OPTIONS, and TRACE methods, but not for other HTTP methods that are more like to cause side-effects of state mutation.
CAPEC-62: Cross Site Request Forgery
An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level. This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.