Monthly
Authentication bypass in Diaple Stela versions prior to 1.60.1 allows an unauthenticated remote attacker to forge the client-side 'authProcess' cookie and impersonate any account, including one with SUPER_ADMIN privileges, ultimately obtaining a valid administrative JWT. Rated CVSS 4.0 9.3 (assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact, no availability impact), the flaw requires no credentials and no victim interaction - only network reachability to a vulnerable instance and knowledge or guessing of a valid target userId. No public exploit code has been identified at time of analysis.
Privilege escalation in the Apache Airflow Keycloak auth manager (apache-airflow-providers-keycloak) affecting Airflow 3.3 and later lets an authenticated user who already holds a valid Airflow session pair it with another subject's Keycloak access or refresh token - obtained out of band via cookie theft, proxy capture or a leaked token - so Airflow authorizes their requests with the foreign token's privileges while the audit log, cache keys and session identity continue to name the attacker's own account. The official CVSS of 9.1 overstates practical risk: exploitation requires both a valid Airflow login and a genuine (not forged) Keycloak token belonging to someone else, and the opt-in Keycloak auth manager is not Airflow's default authentication backend, so the independent assessment rates this CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N rather than AV:N/AC:L/PR:N. There is no public exploit code and no confirmed active exploitation (EPSS 0.21%, 11th percentile); upgrading the provider to 0.10.0 or later restores the subject binding between session and Keycloak tokens.
Session cookie forgery in Dianping CAT (Central Application Tracking) through version 3.1.0 lets remote unauthenticated attackers mint valid administrator sessions. The server uses Java's String.hashCode() as the only integrity check on session cookies without any server-side secret key, so an attacker can compute a matching checksum entirely offline; combining this with a spoofed x-forwarded-for header to defeat IP-binding validation yields a full-access admin session over CAT's configuration. Reported by VulnCheck; no public exploit has been identified at time of analysis, but the technique is fully documented in the advisory and the vulnerable code (TokenBuilder.java, HttpUtils.java) is public.
Cookie shadowing via unanchored regex in AshAdmin (versions 0.9.1-1.3.0) allows an attacker who controls a sibling subdomain to inject state cookies that rebind an administrator's LiveSocket session to an arbitrary actor, tenant, or authorization mode - effectively bypassing the admin panel's authorization controls. The client-side JavaScript cookie parser used `new RegExp(name + "=([^;]+)")`, which matches any cookie whose name merely ends with the target name, enabling a shadowing cookie (e.g., `xactor_authorizing` over `actor_authorizing`) set from a sibling subdomain with `Domain=.example.com` to silently win. No public exploit or CISA KEV listing exists at time of analysis, but the integrity impact is high for any multi-subdomain deployment.
Cross-profile authorization bypass in Hermes WebUI before 0.51.368 allows authenticated users to access sessions, files, and resources belonging to other profiles by forging the hermes_profile cookie. The flaw lives in get_profile_cookie(), which trusted attacker-supplied profile names without binding them to the authenticated session. VulnCheck reported the issue and an upstream patch is available; no public exploit identified at time of analysis.
Authentication bypass in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS allows remote attackers to establish unauthorized VPN connections without valid credentials. The flaw is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, though EPSS remains low at 0.05%, suggesting targeted rather than mass exploitation. Panorama and Cloud NGFW deployments are not affected, but PAN-OS firewalls and Prisma Access tenants running vulnerable trains are exposed.
Unauthenticated privilege escalation in Debugger & Troubleshooter WordPress plugin (versions ≤1.3.2) allows remote attackers to gain administrator access by manipulating a cookie value. Attackers can set the wp_debug_troubleshoot_simulate_user cookie to any user ID without cryptographic validation, bypassing all authentication and authorization checks to immediately impersonate administrators. No public exploit code confirmed at time of analysis, though the attack mechanism is straightforward requiring only cookie manipulation. CVSS 8.8 with network-based attack vector and low complexity indicates significant real-world risk for unpatched installations. Vendor-released patch in version 1.4.0 implements cryptographic token validation.
Cookie host-only protection can be silently stripped from aiohttp's client CookieJar when a client that shares one jar across a parent domain and its subdomains is lured into requesting an attacker-controlled subdomain that returns a same-named cookie carrying an explicit Domain attribute. Only aiohttp releases prior to 3.14.4 are affected, and per the vendor the practical impact is narrow: an attacker gains little unless the application reflects the affected cookies back into a browser context. The issue is low severity (CVSS 2.3, independently assessed as CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N), is not listed in CISA KEV, and no public exploit code was identified at time of analysis; the vendor-released patch is version 3.14.4.
Http4s client applications that keep a cookie jar can leak stored cookies — including session and authentication cookies — to attacker-controlled hosts because versions prior to 0.23.35 and 1.0.0-M47 decide cookie applicability with unanchored substring checks instead of RFC 6265 domain and path matching. A cookie scoped to example.com is therefore also attached to requests for evilexample.com, api.example.com.attacker.net, or an unrelated path, so any attacker who can influence the outbound URL the application requests receives the cookie and can hijack that outbound session. The flaw is fixed in 0.23.35 and 1.0.0-M47; no public exploit code and no CISA KEV entry were identified at time of analysis.
Serendipity's serendipity_setCookie() function accepts unsanitized HTTP_HOST header values as the cookie domain parameter, allowing remote attackers to scope authentication cookies (session tokens, auto-login tokens) to attacker-controlled domains and facilitate session hijacking. The vulnerability requires user interaction (victim authentication during poisoned Host header) and man-in-the-middle or reverse proxy misconfiguration to exploit, affecting all versions of Serendipity that use the vulnerable function. A proof-of-concept demonstrating cookie domain poisoning exists; exploitation probability is moderate (EPSS 6.9, CVSS AC:H reflects attack complexity), and no evidence of active exploitation has been identified.
Authentication bypass in Diaple Stela versions prior to 1.60.1 allows an unauthenticated remote attacker to forge the client-side 'authProcess' cookie and impersonate any account, including one with SUPER_ADMIN privileges, ultimately obtaining a valid administrative JWT. Rated CVSS 4.0 9.3 (assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact, no availability impact), the flaw requires no credentials and no victim interaction - only network reachability to a vulnerable instance and knowledge or guessing of a valid target userId. No public exploit code has been identified at time of analysis.
Privilege escalation in the Apache Airflow Keycloak auth manager (apache-airflow-providers-keycloak) affecting Airflow 3.3 and later lets an authenticated user who already holds a valid Airflow session pair it with another subject's Keycloak access or refresh token - obtained out of band via cookie theft, proxy capture or a leaked token - so Airflow authorizes their requests with the foreign token's privileges while the audit log, cache keys and session identity continue to name the attacker's own account. The official CVSS of 9.1 overstates practical risk: exploitation requires both a valid Airflow login and a genuine (not forged) Keycloak token belonging to someone else, and the opt-in Keycloak auth manager is not Airflow's default authentication backend, so the independent assessment rates this CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N rather than AV:N/AC:L/PR:N. There is no public exploit code and no confirmed active exploitation (EPSS 0.21%, 11th percentile); upgrading the provider to 0.10.0 or later restores the subject binding between session and Keycloak tokens.
Session cookie forgery in Dianping CAT (Central Application Tracking) through version 3.1.0 lets remote unauthenticated attackers mint valid administrator sessions. The server uses Java's String.hashCode() as the only integrity check on session cookies without any server-side secret key, so an attacker can compute a matching checksum entirely offline; combining this with a spoofed x-forwarded-for header to defeat IP-binding validation yields a full-access admin session over CAT's configuration. Reported by VulnCheck; no public exploit has been identified at time of analysis, but the technique is fully documented in the advisory and the vulnerable code (TokenBuilder.java, HttpUtils.java) is public.
Cookie shadowing via unanchored regex in AshAdmin (versions 0.9.1-1.3.0) allows an attacker who controls a sibling subdomain to inject state cookies that rebind an administrator's LiveSocket session to an arbitrary actor, tenant, or authorization mode - effectively bypassing the admin panel's authorization controls. The client-side JavaScript cookie parser used `new RegExp(name + "=([^;]+)")`, which matches any cookie whose name merely ends with the target name, enabling a shadowing cookie (e.g., `xactor_authorizing` over `actor_authorizing`) set from a sibling subdomain with `Domain=.example.com` to silently win. No public exploit or CISA KEV listing exists at time of analysis, but the integrity impact is high for any multi-subdomain deployment.
Cross-profile authorization bypass in Hermes WebUI before 0.51.368 allows authenticated users to access sessions, files, and resources belonging to other profiles by forging the hermes_profile cookie. The flaw lives in get_profile_cookie(), which trusted attacker-supplied profile names without binding them to the authenticated session. VulnCheck reported the issue and an upstream patch is available; no public exploit identified at time of analysis.
Authentication bypass in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS allows remote attackers to establish unauthorized VPN connections without valid credentials. The flaw is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, though EPSS remains low at 0.05%, suggesting targeted rather than mass exploitation. Panorama and Cloud NGFW deployments are not affected, but PAN-OS firewalls and Prisma Access tenants running vulnerable trains are exposed.
Unauthenticated privilege escalation in Debugger & Troubleshooter WordPress plugin (versions ≤1.3.2) allows remote attackers to gain administrator access by manipulating a cookie value. Attackers can set the wp_debug_troubleshoot_simulate_user cookie to any user ID without cryptographic validation, bypassing all authentication and authorization checks to immediately impersonate administrators. No public exploit code confirmed at time of analysis, though the attack mechanism is straightforward requiring only cookie manipulation. CVSS 8.8 with network-based attack vector and low complexity indicates significant real-world risk for unpatched installations. Vendor-released patch in version 1.4.0 implements cryptographic token validation.
Cookie host-only protection can be silently stripped from aiohttp's client CookieJar when a client that shares one jar across a parent domain and its subdomains is lured into requesting an attacker-controlled subdomain that returns a same-named cookie carrying an explicit Domain attribute. Only aiohttp releases prior to 3.14.4 are affected, and per the vendor the practical impact is narrow: an attacker gains little unless the application reflects the affected cookies back into a browser context. The issue is low severity (CVSS 2.3, independently assessed as CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N), is not listed in CISA KEV, and no public exploit code was identified at time of analysis; the vendor-released patch is version 3.14.4.
Http4s client applications that keep a cookie jar can leak stored cookies — including session and authentication cookies — to attacker-controlled hosts because versions prior to 0.23.35 and 1.0.0-M47 decide cookie applicability with unanchored substring checks instead of RFC 6265 domain and path matching. A cookie scoped to example.com is therefore also attached to requests for evilexample.com, api.example.com.attacker.net, or an unrelated path, so any attacker who can influence the outbound URL the application requests receives the cookie and can hijack that outbound session. The flaw is fixed in 0.23.35 and 1.0.0-M47; no public exploit code and no CISA KEV entry were identified at time of analysis.
Serendipity's serendipity_setCookie() function accepts unsanitized HTTP_HOST header values as the cookie domain parameter, allowing remote attackers to scope authentication cookies (session tokens, auto-login tokens) to attacker-controlled domains and facilitate session hijacking. The vulnerability requires user interaction (victim authentication during poisoned Host header) and man-in-the-middle or reverse proxy misconfiguration to exploit, affecting all versions of Serendipity that use the vulnerable function. A proof-of-concept demonstrating cookie domain poisoning exists; exploitation probability is moderate (EPSS 6.9, CVSS AC:H reflects attack complexity), and no evidence of active exploitation has been identified.