GO-2026-5635 nebula-mesh: Session and OIDC state cookies lack the Secure attribute in github.com/juev/nebula-mesh

nebula-mesh: Session and OIDC state cookies lack the Secure attribute in github.com/juev/nebula-mesh...

Sensitive Cookie in HTTPS Session Without "Secure" Attribute

Overview Affected versions of this package are vulnerable to Sensitive Cookie in HTTPS Session Without "Secure" Attribute due to the lack of the Secure attribute on session and OIDC state cookies in the authentication process. An attacker can recover session cookies and impersonate a user or enab...

mod_auth_openidc security update

2.4.10-1 Rebase to 2.4.10 version improves state cookies piling up problem Resolves: RHEL-32450 Race condition in modauthopenidc filecache Resolves: RHEL-25422 modauthopenidc: DoS when using OIDCSessionType client-cookie and manipulating cookies CVE-2024-24814...