Weakness (CWE)
CWE-565: Reliance on Cookies without Validation and Integrity Checking
The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
How to prevent it (4 mitigations)
-
Architecture and Design
Avoid using cookie data for a security-related decision.
-
Implementation
Perform thorough input validation (i.e.: server side validation) on the cookie data if you're going to use it for a security related decision.
-
Architecture and Design
Add integrity checks to detect tampering.
-
Architecture and Design
Protect critical cookies from replay attacks, since cross-site scripting or other attacks may allow attackers to steal a strongly-encrypted cookie that also passes integrity checks. This mitigation applies to cookies that should only be valid during a single transaction or session. By enforcing timeouts, you may limit the scope of an attack. As part of your integrity check, use an unpredictable, server-side value that is not exposed to the client.
Source: MITRE CWE-565
16 results · Clear filters · Feed
-
Critical 9.1
Sunhillo SureLine Authentication Bypass via Session Cookie
Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random id…
-
Critical 9.3
Authentication bypass in Stela by Diaple Networking
Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to the use of a cookie named “authProcess” without validating its integrity. The application stores the user identifier (userId) and the status of the authentication process (validSte…
-
Critical 9.1
Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity
Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization decision from separate, unauthenticated co…
-
Critical 9.8
CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum
CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessio…
-
Critical 9.3CVE-2026-39324 Public exploit
Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization
Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secrets:. If cookie decryption fails, the implementation falls back to a default deco…
-
Critical 9.8
Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution
Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution. Plack::Middleware::Session::Cookie versions through 0.21 has a security vulnerability where it allows an attacker to execute arbitrary code on the server during de…
-
Critical 9.8
WAGO 750-8212 PFC200 G2 2ETH RS Privilege Escalation
WAGO 750-8212 PFC200 G2 2ETH RS firmware contains a privilege escalation vulnerability that allows attackers to manipulate user session cookies. Attackers can modify the cookie's 'name' and 'roles' parameters to elevate from ordinary user to administrative pr…
-
Critical 9.8
An issue was discovered in NJHYST HY511 POE core before 2.1 and plugins before 0.1. The vulnerability stems from the de…
-
Critical 9.8CVE-2025-14440 Public exploit
JAY Login & Register <= 2.4.01 - Authentication Bypass via Cookie
The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. This is due to incorrect authentication checking in the 'jay_login_register_process_switch_back' function with the 'jay_login_regist…
-
Critical 9.8
e-Excellence U-Office Force - Improper Authentication
The U-Office Force from e-Excellence has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to use a particular API and alter cookies to log in as an administrator.
-
Critical 9.8
Cookies Manipulation in Talya Informatics' Elektraweb
Reliance on Cookies without Validation and Integrity Checking vulnerability in Talya Informatics Elektraweb allows Session Credential Falsification through Manipulation, Accessing/Intercepting/Modifying HTTP Cookies, Manipulating Opaque Client-based Data Toke…
-
Critical 9.8
Ruijie RG-NBR700GW 10.3(4b12) router lacks cookie verification when resetting the password, resulting in an administrat…
-
Critical 9.6
Leak of zbx_session cookie when using a scheduled report that includes a dashboard with a URL widget.
The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user.
-
Critical 10.0
CSRF Token Reuse Vulnerability in fiber
Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to inject arbitrary values and forge malicious requests on behalf of a user. This vuln…
-
Critical 10.0
Socomec MOD3GP-SY-120K Reliance on Cookies without Validation and Integrity Checking
Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the web app allows on the device.
-
Critical 9.8
CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.