CakePHP CVE-2026-119416

Requires the victim CakePHP application (≤5.4.3) to use Http\Client with a CookieCollection cookie jar that is reused across outbound requests, and to contact an attacker-controlled or compromised server, or a host whose name has a suffix relationship to a victim domain (e.g. a host ending in the victim domain suffix, or where the cookie Domain is a suffix/parent of the request host). The root cause is unanchored suffix matching: inbound, Set-Cookie Domain values for unrelated hosts were accepted; outbound, the regex '/domain$/' against the host let cookies for 'example.com' leak to 'notexample.com'. Limiting factors: this is a client-side library feature, so applications that do not use Http\Client, or do not persist/share a CookieCollection across hosts, are not exposed; the attacker cannot act purely remotely against a server but must influence which hosts the client talks to or control a suffix-adjacent host (reflected as AC:H/AT:P). Updating is the fix the vendor provides.

This is a moderate-priority, client-side flaw rather than a high-urgency emergency. The CVSS 4.0 base score is 6.3 (Medium) with VC:L/VI:L and no availability impact, and the vector encodes real friction: AC:H and AT:P mean exploitation depends on conditions outside the attacker's full control (the victim CakePHP application must make outbound requests via Http\Client with a reused CookieCollection, and the attacker must control a host whose name has a suffix relationship to a victim domain). PR:N confirms no authentication is required of the attacker's malicious server. No EPSS score and no CISA KEV entry are present in the input, so there is no evidence of mass or active exploitation; the vuln.today decision label is 'this_month', consistent with a patch-soon-not-drop-everything posture. A public technical writeup (abraxaslabs) and a VulnCheck advisory describe the mechanism, which raises the chance of weaponization over time, but neither is marked as confirmed working exploit code. Note one labeling tension to verify: the vector is AV:N yet this is fundamentally a client-side cookie-jar issue triggered when the CakePHP app acts as an HTTP client - the 'network' vector reflects the malicious-server interaction, not a directly reachable server-side endpoint, so defenders should scope risk to applications that actually use Http\Client with a shared cookie collection.

A CakePHP application uses Http\Client with a persistent CookieCollection to call external services, and an attacker controls (or compromises) one of those endpoints or a host whose name shares a suffix with a victim domain. The malicious server returns Set-Cookie headers with crafted Domain values; because of unanchored suffix matching the cookies are accepted into the shared jar and later either replayed to an unrelated victim host or used to plant/overwrite cookies for that host, enabling session cookie leakage or cookie injection. A public technical writeup describing the flaw exists, but it is not verified as working exploit code.