CVE-2026-126067

A flaw was found in Action Pack. Certain non-cookie session stores fail to apply the configured SameSite attribute when issuing session cookies. In web browsers that do not automatically enforce cross-site cookie restrictions, a remote attacker could induce an authenticated user's browser to send...