Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
CWE-614
The Secure attribute for sensitive cookies in HTTPS sessions is not set.
We track 9 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.3.
How this weakness is prevented
- Implementation: Always set the secure attribute when the cookie should be sent via HTTPS only.
Latest Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerabilities
- 8.8 High severity
boruta-server: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.9.1, boruta session cookies and the identity “remember me” cookie were set without the Secure attrib
- 8.8 High severity
haxcms-php: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 25.0.0 and prior to version 26.0.0, the haxcms_refresh_token cookie is set without the Secure flag. This allows it to be transmitted over unencrypted HTTP, making it vulne
- 7.4 High severity
IPP Software: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attacker to intercept the cookie and exploit it through a man‑in‑the‑middle attack. This security issue has been fixed in the latest version of Eat
- 9.1 Critical severity
Firefox: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the `Secure` attribute. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbir
- 8.7 High severity
XPON ONU Wi-Fi Router (DG-GR6821AC): Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
This vulnerability exists in Digisol DG-GR6821AC Router due to misconfiguration of both Secure and HttpOnly flags on session cookies associated with the router web interface. A remote attacker could exploit this vulnerability by capturing the session cookies t
- 7.5 High severity
phpipam/phpipam: Cleartext Transmission of Sensitive Information
In phpipam/phpipam version 1.5.1, the Secure attribute for sensitive cookies in HTTPS sessions is not set. This could cause the user agent to send those cookies in plaintext over an HTTP session, potentially exposing sensitive information. The issue is fixed i
- 8.2 High severity
misskey: Cross-Site Request Forgery
Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some
- 8.6 High severity
CP-XR-DE21-S Router: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
This vulnerability exists in the CP Plus Router due to insecure handling of cookie flags used within its web interface. A remote attacker could exploit this vulnerability by intercepting data transmissions during an HTTP session on the vulnerable system. Succe
- 7.5 High severity
ITarian SaaS platform / on-premise: Incorrect Permission Assignment for Critical Resource
Within the Service Desk module of the ITarian platform (SAAS and on-premise), a remote attacker can obtain sensitive information, caused by the failure to set the HTTP Only flag. A remote attacker could exploit this vulnerability to gain access to the manageme