WebDyne versions from 2.014 up to but not including 3.022 for Perl set session cookies without the Secure, HttpOnly, and SameSite attributes. This allows browsers to send session IDs over unencrypted HTTP and with cross-site requests, exposing them to theft by network attackers or malicious scripts. The issue is fixed in version 3.022.
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14, ThreadSafeCookieStore incompletely validates cookie Domain attributes. Missing private-section and default public-suffix rules, absent A-label normalization, locale-sensitive lowercasing, public-suffix host-only handling, and numeric or IP host checks allow one origin to store a cookie later sent to another origin. Applications sharing one client across trust domains can therefore receive attacker-injected cookies and may be exposed to session fixation. This issue is fixed in version 3.0.14.
AsyncHttpClient versions prior to 3.0.13 and 2.16.1 contain a vulnerability in the ThreadSafeCookieStore where domain attributes are validated but public suffixes are not rejected. This allows a host under a public suffix (e.g., co.uk) to set cookies for the entire suffix, causing cookies to be shared across unrelated hosts. This can lead to injection or overwriting of session-relevant cookies across origins. The issue is fixed in versions 3.0.13 and 2.16.1.
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an unauthenticated attacker to bind a victim's Hatchet session to an attacker-controlled OAuth identity. Exploitation requires the victim to have completed an OAuth flow in the current session and the deployment to enable auth.google.enabled, auth.github.enabled, or the Slack integration. This issue is fixed in version 0.91.1.
OpenAM versions prior to 16.1.1 have a vulnerability where the iPlanetDirectoryPro SSO cookie is set without the HttpOnly flag and lacks a protective SameSite attribute. This allows the cookie to be accessed via same-origin cross-site scripting attacks and reused in OAuth and OpenID Connect consent flows, potentially enabling attackers to steal SSO sessions and perform unauthorized consent grants. The issue is resolved in version 16.1.1.
@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the `state`-based CSRF protection under default usage. Version 0.8.6 has a patch.
CVE-2026-47889 is a high-severity vulnerability in the Spring Framework versions 7.0.0 through 7.0.8 and 6.2.0 through 6.2.19. It affects WebFlux applications running on the Jetty 12 Core reactive adapter, where response cookies are serialized without the SameSite attribute. This omission can cause sensitive cookies to be sent in cross-site requests, increasing the risk of cross-site request forgery (CSRF) attacks. No official patch or remediation guidance is currently available.
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In versions from 2.0.0 prior to 2.16.0 and from 3.0.0.Beta1 prior to 3.0.11, ThreadSafeCookieStore stored a cookie under the value of its Domain attribute without verifying that the responding host is allowed to set a cookie for that domain, leading to a cookie tossing / cookie injection issue. A host the client connects to can therefore plant a cookie scoped to an unrelated domain, and the client will then send that cookie on later requests to that domain. Applications that use a single AsyncHttpClient instance - and thus the default, shared CookieStore - to reach both an attacker-influenced host and a trusted host are impacted. This issue has been fixed in versions 2.16.0 and 3.0.11.
The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web app of PcVue in version 12.0.0 through 16.3.3 included.
HCL AION is affected by a Cookie with Insecure, Improper, or Missing SameSite vulnerability. This can allow cookies to be sent in cross-site requests, potentially increasing exposure to cross-site request forgery and related security risks. This issue affects AION: 2.0.
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.5 and 6.2.1.1 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie.