{"vulnerability": "cve-2026-69215", "sightings": [{"uuid": "ea1607ab-98a8-4f29-8721-4d91034173b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69215", "type": "seen", "source": "https://gist.github.com/alon710/206e1d7f5d7a93ae1831f66088f759d5", "content": "# CVE-2026-69215: CVE-2026-69215: Cross-Origin Cookie Leakage via Improper Domain and Path Matching in http4s CookieJar Client Middleware\n\n> **CVSS Score:** 6.8\n> **Published:** 2026-09-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69215\n\n## Summary\nA medium-severity cross-origin cookie leakage vulnerability exists in the CookieJar client middleware of the http4s library. Due to unanchored substring searches used to determine whether a cookie applies to an outbound request, sensitive cookies (such as session IDs and credentials) can be inadvertently sent to unauthorized domains or paths.\n\n## TL;DR\nAn unanchored substring matching flaw in http4s's CookieJar client middleware allows session cookies to be leaked to attacker-controlled origins during outbound HTTP requests.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-565, CWE-1275\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 6.8 (Medium)\n- **EPSS Score**: Negligible\n- **Impact**: High Confidentiality Loss (Cookie Exfiltration)\n- **Exploit Status**: PoC available in test suite, no weaponized exploits in wild\n- **KEV Status**: Not listed in CISA KEV\n\n## Affected Systems\n\n- http4s client library with CookieJar middleware enabled\n- **http4s-client**: < 0.23.35 (Fixed in: `0.23.35`)\n- **http4s-client**: >= 1.0.0-M1, < 1.0.0-M47 (Fixed in: `1.0.0-M47`)\n\n## Mitigation\n\n- Upgrade the http4s library to a patched version (0.23.35 or 1.0.0-M47)\n- Disable CookieJar middleware if automated cookie persistence is not required\n- Implement strict egress domain allowlisting to restrict outbound requests\n\n**Remediation Steps:**\n1. Identify any usage of http4s-client in your SBT or Maven build configurations.\n2. Verify if CookieJar middleware is utilized in client instantiation code.\n3. Update the http4s-client dependency to 0.23.35 or 1.0.0-M47 in build.sbt.\n4. Recompile the project and run vulnerability checks to ensure no vulnerable transitives remain.\n\n## References\n\n- [GitHub Security Advisory GHSA-grh8-3p95-f9rr](https://github.com/http4s/http4s/security/advisories/GHSA-grh8-3p95-f9rr)\n- [GitHub Commit c0a37f38d5ee2a568ba57bd9da62f8d79b8b1fcc](https://github.com/http4s/http4s/commit/c0a37f38d5ee2a568ba57bd9da62f8d79b8b1fcc)\n- [http4s Release v0.23.35](https://github.com/http4s/http4s/releases/tag/v0.23.35)\n- [http4s Release v1.0.0-M47](https://github.com/http4s/http4s/releases/tag/v1.0.0-M47)\n- [NVD Detail CVE-2026-69215](https://nvd.nist.gov/vuln/detail/CVE-2026-69215)\n- [CVE.org Record CVE-2026-69215](https://www.cve.org/CVERecord?id=CVE-2026-69215)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69215) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-16T11:31:08.588695Z"}]}