AWS VDP: Unauthenticated go-httpbin servers : Leads to Cookie Tossing on *.aws.dev and Open Redirect

Multiple security vulnerabilities were identified in an unauthenticated go-httpbin server instance. An endpoint was found to accept arbitrary cookie domain parameters, allowing attacker-controlled cookies to be set across subdomains of a parent domain. This caused cookies to be delivered to...