A vulnerability in aiohttp's CookieJar persistence causes host-only cookies saved to disk and later restored to lose their host-only attribute. This results in cookies being sent to subdomains that should not receive them, potentially exposing cookie data beyond the intended scope.