A vulnerability in ScoutSuite versions >=5.14.0_13 and <5.14.0_18 allows a subdomain to remove the Host-Only flag from an existing cookie set for a parent domain. This could reduce cookie security protections for users accessing untrusted subdomains. The impact is limited because most use cases do not reflect these cookies back to browsers.