Medium severity · published Oct 30, 2026
CVE-2026-119416
CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching
New
4.8
CVSS
–
EPSS
No
On KEV
Description
CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching. Attackers controlling a host such as one ending in a victim domain suffix, or sending Set-Cookie Domain values for unrelated hosts, can steal session cookies or inject cookies into shared client cookie jars.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
cakephp · cakephp
through 5.4.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-119416
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-119416
patch
https://github.com/cakephp/cakephp/commit/01753266738606bc0e48e61e44a6e252f11386f9
patch
https://github.com/cakephp/cakephp/commit/5d9d01a91f0e678d857a94115de12c3e02f3fbba
patch
https://github.com/cakephp/cakephp/commit/bbba5ed06d5cea7e78333b01e65557cff7a28306
patch
https://github.com/cakephp/cakephp/commit/819b45cbcc5ba864568cb57f62e4fde650b41161
patch
https://github.com/cakephp/cakephp/pull/19702
technical-description
https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Http/Cookie/CookieCollection.php#L315
More from cakephp
9.8
CVE-2023-22727
Database Query::offset() and limit() vulnerable to SQL injection in cakephp
9.2
CVE-2026-79752
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
9.2
CVE-2026-77635
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
8.8
CVE-2020-35239
A vulnerability exists in CakePHP versions 4.0.x through 4.1.3
8.8
CVE-2015-8379
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter