CVE-2026-119416 json
CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching
published 10d ago modified 4d ago also EUVD-2026-113796
- cvss
- 4.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 6%
- public exploits
- 0
- none known
Summary
CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching. Attackers controlling a host such as one ending in a victim domain suffix, or sending Set-Cookie Domain values for unrelated hosts, can steal session cookies or inject cookies into shared client cookie jars.
Patch / fix
- cakephp cakephp 5.4.4
- cakefoundation cakephp 5.4.4
- github.com/cakephp/cakephp@0175326 commit
- github.com/cakephp/cakephp@5d9d01a commit
- github.com/cakephp/cakephp@bbba5ed commit
- github.com/cakephp/cakephp@819b45c commit
- github.com/cakephp/cakephp#19702 pull request
Is CVE-2026-119416 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4d ago
Exploit prediction
0.18% chance of exploitation in the next 30 days, higher than 6% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- abraxaslabs.tech https://abraxaslabs.tech/research/cakephp-cookie-suffix referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 4.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- cakephp cakephp
Classification
- Weakness
-
- CWE-346 Origin Validation Error
References
-
github.com
/cakephp/cakephp/commit/01753266738606bc0e48e61e44a6e252f11386f9
patch
-
github.com
/cakephp/cakephp/commit/5d9d01a91f0e678d857a94115de12c3e02f3fbba
patch
-
github.com
/cakephp/cakephp/commit/bbba5ed06d5cea7e78333b01e65557cff7a28306
patch
-
github.com
/cakephp/cakephp/commit/819b45cbcc5ba864568cb57f62e4fde650b41161
patch
-
github.com
/cakephp/cakephp/pull/19702
patch, issue-tracking
-
abraxaslabs.tech
/research/cakephp-cookie-suffix
third-party-advisory, exploit
-
github.com
/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Http/Cookie/CookieCollection.php#L315
technical-description
-
github.com
/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Http/Cookie/CookieCollection.php#L74
technical-description
-
github.com
/cakephp/cakephp
product
-
vulncheck.com
/advisories/cakephp-through-5.4.3-cookie-leakage-via-http-client-cookiecollection-domain-matching
third-party-advisory
Sources
- CVE List CVE-2026-119416
- NVD CVE-2026-119416
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.