aio-libs/aiohttp · Security
AIOHTTP: Secure attribute not enforced for shared cookie
- GHSA ID
- GHSA-494j-54xm-rwp3
- CVE ID
- CVE-2026-111063
- Severity
- low
- Published
- Updated
Description
Summary
The Secure attribute was not being enforced for the shared cookie.
Impact
It may be possible to send a shared cookie marked Secure through an unencrypted request.
CWEs
- CWE-311 · Missing Encryption of Sensitive Data
- CWE-1004 · Sensitive Cookie Without 'HttpOnly' Flag