GO-2026-5635 nebula-mesh: Session and OIDC state cookies lack the Secure attribute in github.com/juev/nebula-mesh

nebula-mesh: Session and OIDC state cookies lack the Secure attribute in github.com/juev/nebula-mesh...

Sensitive Cookie in HTTPS Session Without "Secure" Attribute

Overview Affected versions of this package are vulnerable to Sensitive Cookie in HTTPS Session Without "Secure" Attribute due to the lack of the Secure attribute on session and OIDC state cookies in the authentication process. An attacker can recover session cookies and impersonate a user or enab...