CVE-2026-69214: CVE-2026-69214: Session Fixation via Arbitrary Set-Cookie Domain Acceptance in http4s CookieJar Middleware

#security #cve #cybersecurity

CVE-2026-69214: Session Fixation via Arbitrary Set-Cookie Domain Acceptance in http4s CookieJar Middleware

Vulnerability ID: CVE-2026-69214
CVSS Score: 6.8
Published: 2026-09-15

A validation flaw exists in the CookieJar client middleware of the http4s library. Prior to versions 0.23.35 and 1.0.0-M47, the middleware trusts server-supplied Domain attributes in HTTP Set-Cookie response headers without confirming that the domain matches the origin host. A malicious server can leverage this to register unauthorized cookies targeting different domains, creating potential session fixation or cookie poisoning vectors.

TL;DR

The http4s CookieJar client middleware accepted arbitrary cookie Domain attributes verbatim without verifying if they matched the issuing server's origin. This enables rogue servers to inject cookies for unrelated target domains in applications utilizing shared CookieJar instances.

Technical Details

CWE ID: CWE-384 / CWE-565
Attack Vector: Network
CVSS v3.1 Score: 6.8 (Medium)
Exploit Maturity: None (No public exploit modules)
CISA KEV Status: Not Listed
Impact: Session Fixation / Cookie Tampering

Affected Systems

http4s-client
http4s-client: < 0.23.35 (Fixed in: 0.23.35)
http4s-client: >= 1.0.0-M1, < 1.0.0-M47 (Fixed in: 1.0.0-M47)

Code Analysis

Commit: 87535f7

Validate Set-Cookie domain against response origin host

--- a/client/shared/src/main/scala/org/http4s/client/middleware/CookieJar.scala
+++ b/client/shared/src/main/scala/org/http4s/client/middleware/CookieJar.scala
@@ -184,8 +184,14 @@ object CookieJar {

   private[middleware] def extractFromResponseCookie(
       m: Map[CookieKey, CookieValue]
-  )(c: ResponseCookie, httpDate: HttpDate, uri: Uri): Map[CookieKey, CookieValue] =
-    c.domain.orElse(uri.host.map(_.value)) match {
+  )(c: ResponseCookie, httpDate: HttpDate, uri: Uri): Map[CookieKey, CookieValue] = {
+    val storedDomain = c.domain match {
+      case Some(d) =>
+        if (uri.host.exists(domainMatches(_, d))) Some(d) else None
+      case None =>
+        uri.host.map(_.value)
+    }
+    storedDomain match {
       case Some(domainS) =>
         val key = CookieKey(c.name, domainS, c.path)
         val newCookie = c.copy(domain = domainS.some)
@@ -195,6 +201,7 @@ object CookieJar {
       case None => // Ignore Cookies We Can't get a domain for
         m
     }
+  }

Mitigation Strategies

Upgrade http4s-client to patched versions (0.23.35 or 1.0.0-M47).
Isolate CookieJar contexts by creating distinct client instances for separate target domains.
Avoid utilizing a shared client instance when querying untrusted multi-tenant endpoints or third-party web services.

Remediation Steps:

Open the build configuration file (e.g., build.sbt).
Locate the http4s-client dependency definition.
Update the version number to at least 0.23.35 or 1.0.0-M47 depending on the release line.
Rebuild and run dependency analysis to confirm no older vulnerable instances are loaded in the classpath.

References

Read the full report for CVE-2026-69214 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community