Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119416CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching

Medium 4.8

In plain English

A medium-severity security flaw in cakephp from cakephp. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)4.8Medium

Exploit odds (30 days)0.2%top 93.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching. Attackers controlling a host such as one ending in a victim domain suffix, or sending Set-Cookie Domain values for unrelated hosts, can steal session cookies or inject cookies into shared client cookie jars.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:22.04:LTS	cakephp	no fix listed	UBUNTU-CVE-2026-119416

Affected products (as reported)

Vendor	Product	Versions
cakephp	cakephp	0 – through 5.4.3

Weakness: CWE-346 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

https://github.com/cakephp/cakephp/commit/01753266738606bc0e48e61e44a6e252f11386f9 patch
https://github.com/cakephp/cakephp/commit/5d9d01a91f0e678d857a94115de12c3e02f3fbba patch
https://github.com/cakephp/cakephp/commit/bbba5ed06d5cea7e78333b01e65557cff7a28306 patch
https://github.com/cakephp/cakephp/commit/819b45cbcc5ba864568cb57f62e4fde650b41161 patch
https://github.com/cakephp/cakephp/pull/19702 patch, issue-tracking
https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Http/Cookie/CookieCollection.php#L315 technical-description
https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Http/Cookie/CookieCollection.php#L74 technical-description
https://abraxaslabs.tech/research/cakephp-cookie-suffix third-party-advisory
https://github.com/cakephp/cakephp product
VulnCheck Advisory: CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching third-party-advisory