Threats tagged 'brew-icloudpd-cve-2026-27205'

A vulnerability in Flask causes the `Vary: Cookie` header to not be added when the session object is accessed in certain ways, such as using the Python `in` operator. This header is important to prevent caching proxies from serving cached responses that may contain user-specific information. The risk depends on the application being behind a caching proxy that does not ignore responses with cookies, the absence of cache-control headers preventing caching, and specific session access patterns. The issue affects icloudpd versions from 1.21.0 up to but not including 1.33.0 and has a low severity score. A fix is available in version 1.33.0.