{"vulnerability": "cve-2026-69214", "sightings": [{"uuid": "d6037466-0b3b-4abd-9e34-4ed89b1e2e5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69214", "type": "seen", "source": "https://gist.github.com/alon710/221abefe2acc671410201ad821c4e263", "content": "# CVE-2026-69214: CVE-2026-69214: Session Fixation via Arbitrary Set-Cookie Domain Acceptance in http4s CookieJar Middleware\n\n> **CVSS Score:** 6.8\n> **Published:** 2026-09-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69214\n\n## Summary\nA validation flaw exists in the CookieJar client middleware of the http4s library. Prior to versions 0.23.35 and 1.0.0-M47, the middleware trusts server-supplied Domain attributes in HTTP Set-Cookie response headers without confirming that the domain matches the origin host. A malicious server can leverage this to register unauthorized cookies targeting different domains, creating potential session fixation or cookie poisoning vectors.\n\n## TL;DR\nThe http4s CookieJar client middleware accepted arbitrary cookie Domain attributes verbatim without verifying if they matched the issuing server's origin. This enables rogue servers to inject cookies for unrelated target domains in applications utilizing shared CookieJar instances.\n\n## Technical Details\n\n- **CWE ID**: CWE-384 / CWE-565\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 6.8 (Medium)\n- **Exploit Maturity**: None (No public exploit modules)\n- **CISA KEV Status**: Not Listed\n- **Impact**: Session Fixation / Cookie Tampering\n\n## Affected Systems\n\n- http4s-client\n- **http4s-client**: < 0.23.35 (Fixed in: `0.23.35`)\n- **http4s-client**: >= 1.0.0-M1, < 1.0.0-M47 (Fixed in: `1.0.0-M47`)\n\n## Mitigation\n\n- Upgrade http4s-client to patched versions (0.23.35 or 1.0.0-M47).\n- Isolate CookieJar contexts by creating distinct client instances for separate target domains.\n- Avoid utilizing a shared client instance when querying untrusted multi-tenant endpoints or third-party web services.\n\n**Remediation Steps:**\n1. Open the build configuration file (e.g., build.sbt).\n2. Locate the http4s-client dependency definition.\n3. Update the version number to at least 0.23.35 or 1.0.0-M47 depending on the release line.\n4. Rebuild and run dependency analysis to confirm no older vulnerable instances are loaded in the classpath.\n\n## References\n\n- [GitHub Security Advisory GHSA-wv64-j4fq-5f9x](https://github.com/http4s/http4s/security/advisories/GHSA-wv64-j4fq-5f9x)\n- [Fix Commit 87535f7](https://github.com/http4s/http4s/commit/87535f7288f3baaf6736e2735087e473762b5b2f)\n- [Release v0.23.35](https://github.com/http4s/http4s/releases/tag/v0.23.35)\n- [Release v1.0.0-M47](https://github.com/http4s/http4s/releases/tag/v1.0.0-M47)\n- [NVD CVE-2026-69214 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-69214)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69214) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-16T12:31:32.389819Z"}]}