Weaknesses of type CWE-614

63 results

Cookie sensível sem o atributo Secure

Quando um cookie contém dados sensíveis (sessão, token, etc.) e não possui o atributo Secure, o navegador o envia também em conexões HTTP (não-criptografadas). Um atacante na rede pode capturar esse cookie e usá-lo para sequestrar a sessão ou roubar credenciais. O erro está em confiar que HTTPS sempre será usado, ou simplesmente não configurar o atributo no servidor.

Example

Um site de banco define Set-Cookie: session_id=abc123 sem Secure. Um usuário acessa via HTTP (ou é redirecionado antes do HTTPS ser aplicado), e o cookie viaja em claro pela rede. Um atacante no mesmo WiFi captura o session_id e acessa a conta do usuário sem saber a senha.

How to mitigate

Configure o atributo Secure em todos os cookies que contenham dados sensíveis (sempre: Set-Cookie: session_id=valor; Secure; HttpOnly; SameSite=Strict). Use HSTS para forçar HTTPS desde o primeiro acesso e impeça fallback para HTTP.

CVE-2026-48058MEDIUMnebula-mesh: Session and OIDC state cookies lack the Secure attributeEPSS 0.2%CVE-2026-11956MEDIUMTwiN gatus OIDC Session Cookie oidc.go setSessionCookie missing secure attributeEPSS 0.2%CVE-2026-46398HIGHHAX CMS Missing Secure Flag on CookieEPSS 0.2%CVE-2024-55897MEDIUMIBM PowerHA SystemMirror for i information disclosureEPSS 0.2%CVE-2024-28770MEDIUMIBM Security Directory Integrator information disclosureEPSS 0.2%CVE-2024-28771MEDIUMIBM Security Directory Integrator information disclosureEPSS 0.2%CVE-2024-58317MEDIUMKentico Xperience <= 13.0.164 Cookie Security ConfigurationEPSS 0.2%CVE-2026-22617MEDIUMEaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attacker to intercept the cEPSS 0.2%CVE-2025-36011MEDIUMIBM Jazz for Service Management information disclosureEPSS 0.2%CVE-2025-36249LOWIBM Jazz for Service Management is vulnerable to "filter" cookie not sent over SSLEPSS 0.1%CVE-2025-52632MEDIUMHCL AION is susceptible to Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerabilityEPSS 0.1%CVE-2025-36026MEDIUMIBM Datacap information disclosureEPSS 0.1%CVE-2025-24897HIGHMisskey CSRF vulnerability due to insecure configuration of authentication cookie attributesEPSS 0.1%CVE-2025-52614LOWHCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerabilityEPSS 0.1%CVE-2026-57948HIGHPinpoint - Insecure Session Cookie Attributes in pinpointJwtEPSS 0.1%CVE-2026-4820MEDIUMIBM Maximo Application Suite was vulnerable to because Cookie ltpatoken2_<workspace_name> was not set with secure flagEPSS 0.1%CVE-2026-1697MEDIUMUse of unsecure cookies for GraphicalData web service and WebClient web appEPSS 0.1%CVE-2024-30142LOWHCL BigFix Compliance is affected by a missing secure flag on a cookieEPSS 0.1%CVE-2026-32745MEDIUMIn JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settingsEPSS 0.1%CVE-2026-56581LOWHCL MyCloud was affected with Cookie Attribute Path Not SetEPSS 0.1%