Common Weakness Enumeration

CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Description

The Secure attribute for sensitive cookies in HTTPS sessions is not set.

Associated Reviewed Advisories

Vulnerabilities classified under CWE-614 ordered by modification date.

17 reviewed records

Advisory ID	NVD ID	Severity	PURLs	Summary	Last Modified
GHSA-f74w-272x-mqcv	CVE-2026-46550	MODERATE	npm/nocodb	NocoDB: Refresh Token Cookie Set Without `secure` and `sameSite` Flags	2026-07-20
GHSA-95v7-h9j5-gvjr	CVE-2026-41017	MODERATE	pypi/apache-airflow	Apache Airflow has a Sensitive Cookie in HTTPS Session Without 'Secure' Attribute	2026-07-09
GHSA-c6r4-qjmw-cvj2	CVE-2026-43828	MODERATE	maven/org.apache.shiro/shiro-web	Apache Shiro sends sensitive cookies in HTTPS session without 'Secure' attribute	2026-06-30
GHSA-rqfj-vv8r-xhqc	CVE-2026-48058	MODERATE	golang/github.com/juev/nebula-mesh	nebula-mesh: Session and OIDC state cookies lack the Secure attribute	2026-06-10
GHSA-5j35-xr4g-vwf4	-	LOW	npm/@grackle-ai/server	@grackle-ai/server has a Missing Secure Flag on Session Cookie	2026-03-25
GHSA-379p-37xc-q963	CVE-2016-11076	HIGH	golang/github.com/mattermost/mattermost-server	Mattermost Server does not check if cookies are used over SSL	2025-10-22
GHSA-vpxm-cr3r-pjp9	-	CRITICAL	maven/org.openmrs.module/addresshierarchy maven/org.openmrs.module/attachments maven/org.openmrs.module/idgen maven/org.openmrs.module/legacyui maven/org.openmrs.module/patientflags maven/org.openmrs/openmrs	General OpenMRS Security Advisory, January 2025: Penetration Testing Results and Patches	2025-01-30
GHSA-r3jq-4r5c-j9hp	CVE-2024-47833	MODERATE	pypi/taipy	Taipy has a Session Cookie without Secure and HTTPOnly flags	2025-01-21
GHSA-mjw4-xvx6-3grg	CVE-2022-3174	HIGH	pypi/rdiffweb	rdiffweb vulnerable to Sensitive Cookie in HTTPS Session Without 'Secure' Attribute	2024-10-25
GHSA-m748-hjqg-rpp8	CVE-2022-3250	MODERATE	pypi/rdiffweb	rdiffweb has insecure HTTP cookies	2024-10-25
GHSA-8255-qf34-44mp	CVE-2017-1000046	HIGH	-	Sensitive Cookie Without HttpOnly and Secure Flag	2024-04-23
GHSA-hhxg-px5h-jc32	CVE-2018-25060	HIGH	golang/github.com/go-macaron/csrf	Macaron csrf missing encryption and has sensitive cookies in HTTP session without secure attribute	2024-03-01
GHSA-34w4-wrqp-j47g	CVE-2023-5866	MODERATE	-	Sensitive cookie in HTTPS session without 'Secure' attribute in thorsten/phpmyfaq	2023-10-31
GHSA-m3g7-wrrq-v5c8	CVE-2023-0055	MODERATE	pypi/pyload-ng	Pyload contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute	2023-01-11
GHSA-qcw2-492v-57xj	CVE-2022-4683	MODERATE	golang/github.com/usememos/memos	usememos/memos missing Secure cookie attribute	2023-01-02
GHSA-wpgc-5cr5-h9gg	CVE-2022-4409	HIGH	-	phpMyFAQ has insecure HTTP cookies	2022-12-13
GHSA-rqph-25q9-9jhp	CVE-2015-3207	MODERATE	golang/github.com/openshift/origin	Insecure cookies in Openshift Origin	2022-07-15