Improper Cookie Domain

Http4s is vulnerable to improper cookie domain. The vulnerability is due to unanchored substring checks instead of RFC 6265-compliant domain and path matching when attaching stored cookies, which allows an attacker to exploit an application’s attacker-influenced outbound request to obtain session...