Threats Tagged 'cwe-1275'

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an unauthenticated attacker to bind a victim's Hatchet session to an attacker-controlled OAuth identity. Exploitation requires the victim to have completed an OAuth flow in the current session and the deployment to enable auth.google.enabled, auth.github.enabled, or the Slack integration. This issue is fixed in version 0.91.1.

Open Access Management (OpenAM) prior to version 16.1.1 has a vulnerability where the default configuration sets the iPlanetDirectoryPro SSO cookie without HttpOnly and SameSite protections. This cookie is reused as a CSRF token in OAuth and OpenID Connect consent flows. Combined with same-origin cross-site scripting and user interaction with attacker-controlled links, this can lead to theft of the SSO session and unauthorized consent grants. The issue is fixed in version 16.1.1.

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the `state`-based CSRF protection under default usage. Version 0.8.6 has a patch.

CVE-2026-47889 is a high-severity vulnerability in the Spring Framework affecting versions 7.0.0 through 7.0.8 and 6.2.0 through 6.2.19. It involves a WebFlux application running on the Jetty 12 Core reactive adapter that serializes response cookies without setting the SameSite attribute. This omission can lead to sensitive cookies being sent in cross-site requests, potentially exposing them to cross-site request forgery (CSRF) attacks. No official patch or remediation guidance is currently available.

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In versions from 2.0.0 prior to 2.16.0 and from 3.0.0.Beta1 prior to 3.0.11, ThreadSafeCookieStore stored a cookie under the value of its Domain attribute without verifying that the responding host is allowed to set a cookie for that domain, leading to a cookie tossing / cookie injection issue. A host the client connects to can therefore plant a cookie scoped to an unrelated domain, and the client will then send that cookie on later requests to that domain. Applications that use a single AsyncHttpClient instance - and thus the default, shared CookieStore - to reach both an attacker-influenced host and a trusted host are impacted. This issue has been fixed in versions 2.16.0 and 3.0.11.

The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web app of PcVue in version 12.0.0 through 16.3.3 included.

MediumVulnerabilityUnited StatesFranceGermany+7#cve#cve-2026-1697#cwe-614

HCL AION is affected by a Cookie with Insecure, Improper, or Missing SameSite vulnerability. This can allow cookies to be sent in cross-site requests, potentially increasing exposure to cross-site request forgery and related security risks. This issue affects AION: 2.0.

MediumVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2025-52628#cwe-1275

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.5 and 6.2.1.1 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie.

LowVulnerabilityGermanyFranceUnited Kingdom+3#cve#cve-2025-36134#cwe-1275