CVE-2026-15076 describes an origin validation error (CWE-346) in Eclipse Vert.x Web Client's WebClientSession component. The vulnerability arises because the component does not verify that the Domain attribute in Set-Cookie headers matches the domain of the server that sent the response, violating RFC 6265 section 5.3. An attacker controlling any server contacted by the victim can inject cookies scoped to arbitrary third-party domains. Since the session store does not perform cross-domain ownership checks, it stores and later sends these attacker-injected cookies to the targeted domains. This can cause the targeted service to process requests under the attacker's account, potentially exposing sensitive information such as payment details or API payloads.

An attacker who controls any server contacted by the victim application can inject cookies scoped to arbitrary third-party domains. When the victim subsequently sends requests to those domains using the same WebClientSession, the attacker-injected cookies are presented, causing the targeted service to treat the requests as coming from the attacker’s account. This can lead to unauthorized access to sensitive data included in the victim's requests, such as payment information or API payloads.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, avoid using vulnerable versions of Eclipse Vert.x Web Client in contexts where untrusted servers are contacted or isolate WebClientSession usage to trusted domains only.