cve.bz

CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Filter

The Secure attribute for sensitive cookies in HTTPS sessions is not set.

What the weakness is: CWE-614 at MITRE. OWASP Top 10: A02:2025 Security Misconfiguration

Related attack patterns (CAPEC): 1
  • CAPEC-102 Session Sidejacking Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-614, as MITRE names them. Credits.

Ask an AI about CWE-614

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/614.html and https://cve.bz/cve/cwe/614?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. –CVE-2026-78188EPSS 0.1%

    WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes. WebDyne::Session sets its session cookie with only a name, value and path. Browsers then send the session ID ov…

  2. 2.1CVE-2026-115519EPSS 0.2%

    Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise user sessions if other security issues such as a cross-site scripting vulnerability or a ma…

  3. 2.2CVE-2026-56599EPSS 0.06%

    HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to exploit missing security attributes such as SameSite, HttpOnly, Secure, and restrictive Paths, enabling…

  4. 3.1CVE-2026-66249EPSS 0.1%

    iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies transmitted over unencrypted HTTP connections, enabling the unauthorized extraction of sensitive information such as sessi…

  5. 2.3CVE-2026-65655EPSS 0.4%

    When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server…

  6. 4.3CVE-2026-15656EPSS 0.2%

    IBM Maximo Application Suite 9.2, 9.1, and 9.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a s…

  7. 4.6CVE-2026-48058EPSS 0.2%

    nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single pla…

  8. 2.6CVE-2026-56581EPSS 0.2%

    HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data or authentication tokens.

  9. 4.2CVE-2024-23572EPSS 0.1%

    HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

  10. 7.6CVE-2026-57948EPSS 0.2%

    Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to missing HttpOnly and Secure attributes, enabling JavaScript access via document.cook…

  11. 5.4CVE-2026-46550EPSS 0.2%

    NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the refresh-token cookie was set with httpOnly: true but missing both the secure flag and the sameSite attribute. Over plain HTTP the cookie could be intercepte…

  12. 8.8CVE-2026-53661EPSS 0.3%

    Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.9.1, boruta session cookies and the identity “remember me” cookie were set with…

  13. 6.3CVE-2026-11956EPSS 0.2%

    A vulnerability was determined in TwiN gatus 5.36.0. Impacted is the function setSessionCookie of the file security/oidc.go of the component OIDC Session Cookie Handler. Executing a manipulation can lead to sensitive cookie without secure …

  14. 8.8CVE-2026-46398EPSS 0.2%

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 25.0.0 and prior to version 26.0.0, the haxcms_refresh_token cookie is set without the Secure flag. This allows it to be transmitted over unencrypted …

  15. 4.3CVE-2025-52608EPSS 0.10%

    HCL iControl was affected by Missing Cookie Attributes vulnerability. It was observed that the application is missing several critical cookie attributes, including Secure and SameSite. And also path is set to root.

  16. 5.9CVE-2026-41017EPSS 0.4%

    Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure` flag, so deployments running the Airflow API server behind an HTTPS-terminating reverse proxy (e.g. nginx / Envoy / a managed load balancer that terminate…

  17. 5.9CVE-2026-43828EPSS 0.3%

    Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.…

  18. 7.4CVE-2026-22617EPSS 0.2%

    Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attacker to intercept the cookie and exploit it through a man‑in‑the‑middle attack. This security issue has been fixed in the …

  19. 4.3CVE-2026-4820EPSS 0.1%

    IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link…

  20. 5.7CVE-2026-32745EPSS 0.1%

    In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings

  21. 5.3CVE-2026-1697EPSS 0.1%

    The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web app of PcVue in version 12.0.0 through 16.3.3 included.

  22. 6.9CVE-2024-58317EPSS 0.2%

    A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL requirements when setting administration cookies via web.config. The vulnerability affects .NET Framework projects by incorrectly handling th…

  23. 5.3CVE-2025-36249EPSS 0.2%

    IBM Jazz for Service Management 1.1.3.0 through 1.1.3.25 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this l…

  24. 4.3CVE-2025-52614EPSS 0.1%

    HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability. A malicious agent may be able to induce this event by feeding a user suitable links, either directly or via another web site.

  25. 7.5CVE-2025-52632EPSS 0.1%

    A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue affects AION: 2.0.

  26. 4.3CVE-2025-36011EPSS 0.2%

    IBM Jazz for Service Management 1.1.3.0 through 1.1.3.24 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this l…

  27. 9.1CVE-2025-8037EPSS 0.3%

    Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the `Secure` attribute. This vulnerability was fixed in Firefox 141, Firefox …

  28. 8.7CVE-2025-53757EPSS 0.3%

    This vulnerability exists in Digisol DG-GR6821AC Router due to misconfiguration of both Secure and HttpOnly flags on session cookies associated with the router web interface. A remote attacker could exploit this vulnerability by capturing …

  29. 6.5CVE-2025-27450EPSS 0.3%

    The Secure attribute is missing on multiple cookies provided by the MEAC300-FNADE4. An attacker can trick a user to establish an unencrypted HTTP connection to the server and intercept the request containing the PHPSESSID cookie.

  30. 4.3CVE-2025-36026EPSS 0.2%

    IBM Datacap 9.1.7, 9.1.8, and 9.1.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the u…

  31. 7.5CVE-2024-10718EPSS 0.3%

    In phpipam/phpipam version 1.5.1, the Secure attribute for sensitive cookies in HTTPS sessions is not set. This could cause the user agent to send those cookies in plaintext over an HTTP session, potentially exposing sensitive information.…

  32. 8.2CVE-2025-24897EPSS 0.1%

    Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bu…

  33. 6.8CVE-2025-24390EPSS 0.2%

    A vulnerability in OTRS Application Server and reverse proxy settings allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTRS 202…

  34. 6.5CVE-2024-28771EPSS 0.2%

    IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// l…

  35. 6.5CVE-2024-28770EPSS 0.2%

    IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// l…

  36. 8.6CVE-2025-0479EPSS 0.5%

    This vulnerability exists in the CP Plus Router due to insecure handling of cookie flags used within its web interface. A remote attacker could exploit this vulnerability by intercepting data transmissions during an HTTP session on the vul…

  37. 4.3CVE-2024-55897EPSS 0.2%

    IBM PowerHA SystemMirror for i 7.4 and 7.5 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a sit…

  38. 3.8CVE-2024-30142EPSS 0.1%

    HCL BigFix Compliance is affected by a missing secure flag on a cookie. If a secure flag is not set, cookies may be stolen by an attacker using XSS, resulting in unauthorized access or session cookies could be transferred over an unencryp…

  39. 6.3CVE-2024-47833EPSS 0.3%

    Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions session cookies are served without Secure and HTTPOnly flags. This issue has been …

  40. 4.3CVE-2024-43180EPSS 0.2%

    IBM Concert 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cooki…

  41. 6.9CVE-2024-41684EPSS 0.2%

    This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing secure flag for the session cookies associated with the router's web management interface. An attacker with remote access could exploit this by intercepting tra…

  42. 4.3CVE-2024-39734EPSS 0.2%

    IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting thi…

  43. 5.3CVE-2023-33860EPSS 0.2%

    IBM Security QRadar EDR 3.12 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes …

  44. 6.8CVE-2024-35211EPSS 0.2%

    A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server, after a successful login, sets the session cookie on the browser, without applying any security attributes (…

  45. 7.5CVE-2024-2493EPSS 0.3%

    Session Hijacking vulnerability in Hitachi Ops Center Analyzer.This issue affects Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.1-00.

  46. 4.3CVE-2023-46179EPSS 0.3%

    IBM Sterling Secure Proxy 6.0.3 and 6.1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site t…

  47. 4.3CVE-2023-42016EPSS 0.3%

    IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http…

  48. 5.3CVE-2024-0349EPSS 0.4%

    A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to sensitive cookie without secure attribute. …

  49. 5.3CVE-2023-5035EPSS 0.2%

    A vulnerability has been identified in PT-G503 Series firmware versions prior to v5.2, where the Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the cookie to be transmitted in plaintext over an HTTP …

  50. 5.7CVE-2023-5866EPSS 0.3%

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.2.1.