CVE-2026-119416mediumCWE-346

CVE-2026-119416: medium-severity vulnerability in cakephp

CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching

Published

Follow this CVE+ Monitor cakephp

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.3epss 0.2%
CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching. Attackers controlling a host such as one ending in a victim domain suffix, or sending Set-Cookie Domain values for unrelated hosts, can steal session cookies or inject cookies into shared client cookie jars.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
cakephp · cakephp
Related CVEs — cakephp

In the same product, most dangerous first.

CVE-2023-22727CRITICALDatabase Query::offset() and limit() vulnerable to SQL injection in cakephpEPSS 0.9%CVE-2026-79752CRITICALCakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injectionEPSS 0.6%CVE-2026-77634HIGHCakePHP: SmtpTransport vulnerable to CRLF header injectionEPSS 0.5%CVE-2026-77635CRITICALCakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriverEPSS 0.5%CVE-2026-119418CRITICALCakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()EPSS 0.5%CVE-2026-119417MEDIUMCakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransportEPSS 0.5%