CVE-2026-11956

Katalog CVE

CVSS 3.7 · Low EPSS 0,19%

Kerentanan Sensitive Cookie in HTTPS Session Without 'Secure' Attribute. Skor CVSS 3.1 3.7 (Low) menurut vuldb.com.

Deskripsi (NVD)

A vulnerability was determined in TwiN gatus 5.36.0. Impacted is the function setSessionCookie of the file security/oidc.go of the component OIDC Session Cookie Handler. Executing a manipulation can lead to sensitive cookie without secure attribute. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The reported GitHub issue was closed with the label "not planned".

Rincian

Terbit di NVD

11 Juni 2026

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

3.7 (Low), sumber vuldb.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 8,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/TwiN/gatus/
• https://github.com/TwiN/gatus/issues/1689
• https://vuldb.com/cve/CVE-2026-11956
• https://vuldb.com/submit/836328
• https://vuldb.com/vuln/370343
• https://vuldb.com/vuln/370343/cti