UBUNTU-CVE-2026-119416: Medium severity ubuntu/cakephp vulnerability
CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching. Attackers controlling a host such as one ending in a victim domain suffix, or sending Set-Cookie Domain values for unrelated hosts, can steal session cookies or inject cookies into shared client cookie jars.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using CakePHP's HTTP client and its CookieCollection are exposed when they communicate with attacker-controlled or otherwise malicious servers. The impact is relevant where cookies are shared or reused in the client cookie jar, including session cookies.
What does an attacker need to exploit it?
An attacker needs to control a server hostname that ends in a victim domain suffix, or be able to send Set-Cookie headers with Domain values for unrelated hosts. No authentication or user interaction is required, but exploitation has high attack complexity.
Are applications affected by simply serving CakePHP web requests?
The described vulnerable component is the CakePHP HTTP Client CookieCollection. The provided information identifies risk when the application acts as an HTTP client that receives and stores cookies from remote servers.
How can I assess whether my application may already be affected?
Review uses of the CakePHP HTTP client for requests to untrusted, externally controlled, or redirectable hosts, and determine whether its cookie jar contains reusable authentication or session cookies. Also inspect whether received Set-Cookie headers can specify domains unrelated to the host contacted.