CVE-2026-119416

CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching. Attackers controlling a host such as one ending in a victim domain suffix, or...

CVE-2026-119416 CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching

CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching. Attackers controlling a host such as one ending in a victim domain suffix, or...

CVE-2026-119416

CakePHP versions through 5.4.3 are vulnerable to an improper cookie domain validation flaw in the Http Client CookieCollection component. The root cause is unanchored suffix matching , which allows malicious servers to abuse the Set-Cookie Domain attribute. Attackers controlling a host with a suf...

EUVD-2026-113796

CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching. Attackers controlling a host such as one ending in a victim domain suffix, or...

PT-2026-133469

CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching. Attackers controlling a host such as one ending in a victim domain suffix, or...