AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

Summary A subdomain can remove the Host-Only flag from an existing cookie to a parent domain. Impact A user accessing untrusted subdomains could see their Host-Only protections stripped from cookies. Given most usecases won't reflect these cookies to a browser, the impact is limited...

GHSA-GX76-C99X-2C96 AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

Summary A subdomain can remove the Host-Only flag from an existing cookie to a parent domain. Impact A user accessing untrusted subdomains could see their Host-Only protections stripped from cookies. Given most usecases won't reflect these cookies to a browser, the impact is limited...