CVE-2026-119416 in CakePHP
Summary
by MITRE • 10/30/2026
CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching. Attackers controlling a host such as one ending in a victim domain suffix, or sending Set-Cookie Domain values for unrelated hosts, can steal session cookies or inject cookies into shared client cookie jars.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in CakePHP versions through 5.4.3 represents a critical flaw within the Http Client CookieCollection component, specifically stemming from improper validation of domain attributes during cookie handling operations. This issue arises because the library employs an unanchored suffix matching algorithm to determine whether a received Set-Cookie Domain attribute is valid for the current request context. In standard web security practices, such as those outlined in RFC 6265, domain matching must be precise and anchored to ensure that cookies are only accepted by domains or subdomains that explicitly belong to the target entity. By failing to anchor this validation logic, CakePHP inadvertently allows malicious servers to exploit ambiguous string comparisons, thereby bypassing standard same-origin policy protections inherent in cookie storage mechanisms.
From a technical perspective, the core of the flaw lies in how the CookieCollection processes incoming Set-Cookie headers from remote hosts. When an attacker controls or influences a host whose name ends with a suffix that matches part of the victim's domain, such as example.com being matched by evil-example.com due to loose substring logic, the library incorrectly accepts these cookies. Furthermore, attackers can send Set-Cookie Domain values for completely unrelated hosts if the validation logic does not strictly enforce hierarchical containment rules. This lack of strict anchoring means that any arbitrary string ending in a specific sequence is deemed valid, creating a significant attack surface where malicious actors can inject unauthorized state data into the client's cookie jar or extract sensitive session identifiers intended for other domains.
The operational impact of this vulnerability is severe, primarily centering on session hijacking and cross-site request forgery facilitation. If an attacker successfully plants cookies via this mechanism, they gain the ability to impersonate legitimate users by stealing their session tokens. This compromises user confidentiality and integrity, potentially leading to unauthorized access to sensitive accounts or data. Additionally, injecting malicious cookies into shared client cookie jars can allow attackers to manipulate application behavior on behalf of victims, facilitating further attacks such as cross-site scripting exploitation chains or privilege escalation within the affected web applications. The ability to steal session cookies directly undermines authentication mechanisms, while the injection capability allows for persistent manipulation of user sessions across different requests and potentially different endpoints within the same domain context.
This vulnerability aligns with CWE-613, which classifies insufficient validation of cookie attributes, as well as CWE-200, involving exposure of sensitive information to an unauthorized actor. In terms of offensive security frameworks like MITRE ATT&CK, this flaw supports techniques related to Collection of Application Data and Session Hijacking, specifically under tactics that involve gaining access to user credentials or session tokens through client-side vulnerabilities. The exploitation vector typically involves a malicious server responding to legitimate requests with crafted Set-Cookie headers designed to trigger the flawed suffix matching logic in the CakePHP Http Client.
To mitigate this risk, organizations using affected versions of CakePHP should immediately upgrade to version 5.4.3 or later where these validation checks have been corrected to enforce strict domain containment rules. Developers must ensure that cookie handling libraries adhere strictly to RFC standards for domain attribute parsing, ensuring that only exact matches or valid subdomain hierarchies are accepted. Additionally, implementing secure flag configurations such as Secure and HttpOnly on cookies can reduce the impact of potential session theft by preventing transmission over unencrypted channels and restricting access via client-side scripts respectively. Regular security audits focusing on third-party library dependencies and their handling of HTTP headers are essential to maintain robust defense-in-depth strategies against similar implementation flaws in web application frameworks.