Description
In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| JetBrains | Ktor | < 3.6.1 | 3.6.1 |
Low · 3.7
CVE-2026-123319
EUVD-2026-118083GHSA-2qr9-2f88-gccj
In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection
Published Nov 6, 2026 · Updated Nov 10, 2026 · Assigned by JetBrains