CWE-1275 Sensitive Cookie with Improper SameSite Attribute
Description
The SameSite attribute for sensitive cookies is not set, or an insecure value is used.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-1275 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-f9m8-cv68-674w | CVE-2026-107280 | MODERATE |
AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk |
2026-10-08 | |
| GHSA-phg3-3g28-wq9v | CVE-2026-61687 | HIGH |
Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState |
2026-09-21 | |
| GHSA-grh8-3p95-f9rr | CVE-2026-69215 | MODERATE |
Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin |
2026-09-15 | |
| GHSA-fm3f-ch8h-qw8q | CVE-2026-81888 | MODERATE |
@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking |
2026-08-31 | |
| GHSA-m452-q8c9-rg2f | CVE-2026-55688 | MODERATE |
AsyncHttpClient stores cookie for an unrelated domain (cookie tossing) via ThreadSafeCookieStore |
2026-08-26 | |
| GHSA-fpmh-vx4h-xc33 | CVE-2026-53660 | HIGH |
OpenAM Insecure SSO Cookie Initialization |
2026-08-14 | |
| GHSA-mpq2-mv8p-9wm6 | CVE-2026-8413 | LOW | - |
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design |
2026-06-24 |
| GHSA-cv8h-r7r5-vwj9 | CVE-2023-53957 | HIGH | - |
Kimai contains a SameSite cookie vulnerability |
2026-02-20 |