VYPR

CWE-1275

Sensitive Cookie with Improper SameSite Attribute

VariantIncompleteLikelihood: Medium

Description

The SameSite attribute for sensitive cookies is not set, or an insecure value is used.

The SameSite attribute controls how cookies are sent for cross-domain requests. This attribute may have three values: 'Lax', 'Strict', or 'None'. If the 'None' value is used, a website may create a cross-domain POST HTTP request to another website, and the browser automatically adds cookies to this request. This may lead to Cross-Site-Request-Forgery (CSRF) attacks if there are no additional protections in place (such as Anti-CSRF tokens).

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-62

CVEs mapped to this weakness (26)

page 2 of 2
  • CVE-2025-24387MedMar 10, 2025
    risk 0.31cvss 4.8epss 0.00

    A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. A request to an OTRS endpoint from a possible malicious web site, would send the authentication cookie, performing an unwanted read…

  • CVE-2025-52628MedFeb 3, 2026
    risk 0.30cvss 4.6epss 0.00

    HCL AION is affected by a Cookie with Insecure, Improper, or Missing SameSite vulnerability. This can allow cookies to be sent in cross-site requests, potentially increasing exposure to cross-site request forgery and related security risks. This issue affects AION: 2.0.

  • CVE-2025-36134LowNov 25, 2025
    risk 0.24cvss 3.7epss 0.00

    IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.5 and 6.2.1.1 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie.

  • CVE-2024-43173LowOct 22, 2024
    risk 0.24cvss 3.7epss 0.00

    IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute.

  • CVE-2026-55688MedJul 1, 2026
    risk 0.19cvss 4.0epss 0.00

    The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In versions from 2.0.0 prior to 2.16.0 and from 3.0.0.Beta1 prior to 3.0.11, ThreadSafeCookieStore stored a cookie under the value of its Domain…

  • CVE-2025-24897HigFeb 11, 2025
    risk 0.00cvss 8.2epss 0.00

    Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some of the APIs of…