Dashboard / CVE-2026-100725

CVE-2026-100725

HIGH
MEDIUM Priority: 0.02 BB Relevance: 77/100
Published: 2026-09-27 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
AT: Present
VC: High
VI: Low
VA: None

Description

http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by ClientFilters.Cookies) that does not enforce RFC 6265 scoping rules for the cookie domain, path, and Secure attributes. When a single BasicCookieStorage instance is used to talk to more than one origin or scheme, cookies stored for one origin can be sent to other origins, and cookies marked Secure can be sent over plain HTTP, potentially disclosing session cookies or other sensitive values to unauthorized hosts or network observers. Clients that use a storage instance for a single origin are not affected.

Weakness Classification (1)

Affected Software (6)

VendorProductVersion
http4k http4k 6.0.0.0 < 6.48.0.0
http4k http4k 5.0.0.0 < 5.42.0.0
http4k http4k 0 < 4.51.0.0
http4k http4k 6.0.0.0 < 6.48.0.0
http4k http4k 5.0.0.0 < 5.42.0.0
http4k http4k 0 < 4.51.0.0

References & Advisories (3)

Bug Bounty Relevance

77 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

8.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.24%
Raw Score 0.002390
Percentile 15.0%
Date 2026-10-29

Intelligence Sources

mitre ref →
nvd ref →

External Links