CVE-2026-100725: http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage
http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by ClientFilters.Cookies) that does not enforce RFC 6265 scoping rules for the cookie domain, path, and Secure attributes. When a single BasicCookieStorage instance is used to talk to more than one origin or scheme, cookies stored for one origin can be sent to other origins, and cookies marked Secure can be sent over plain HTTP, potentially disclosing session cookies or other sensitive values to unauthorized hosts or network observers. Clients that use a storage instance for a single origin are not affected.
Affected Software
Event History
Frequently Asked Questions
Which client applications are exposed?
Applications are affected only when they use ClientFilters.Cookies with one BasicCookieStorage instance to communicate with more than one origin or scheme. Clients whose storage instance is limited to a single origin are not affected.
What could an attacker gain from this issue?
Cookies stored for one origin may be sent to another origin, potentially disclosing session cookies or other sensitive values to an unauthorized host. Cookies marked Secure may also be transmitted over plain HTTP, exposing them to network observers.
Does exploitation require an authenticated user or user interaction?
No privileges or user interaction are required according to the supplied vector. Exploitation is network-reachable but has high attack complexity.
Which versions address the issue?
The issue affects versions before 6.48.0.0, 5.42.0.0, and 4.51.0.0. Upgrade to an applicable fixed version in the relevant release line.