Vulnerability · Published Jun 11, 2026 · Assigned by VulDB

CVE-2026-11956TwiN gatus OIDC Session Cookie oidc.go setSessionCookie missing secure attribute

Low 3.7

In plain English

A low-severity security flaw in gatus from TwiN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.2%top 91.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in TwiN gatus 5.36.0. Impacted is the function setSessionCookie of the file security/oidc.go of the component OIDC Session Cookie Handler. Executing a manipulation can lead to sensitive cookie without secure attribute. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The reported GitHub issue was closed with the label "not planned".

Affected products (as reported)

Vendor	Product	Versions
TwiN	gatus	5.36.0

Weakness: CWE-614, CWE-1004 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R

References

VDB-370343 | TwiN gatus OIDC Session Cookie oidc.go setSessionCookie missing secure attribute vdb-entry, technical-description
VDB-370343 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-11956 | CVE Analysis and Report third-party-advisory
Submit #836328 | TwiN gatus 5.36.0 Sensitive Cookie Without Secure Attribute third-party-advisory
https://github.com/TwiN/gatus/issues/1689 issue-tracking
https://github.com/TwiN/gatus/ product