CVE-2026-119416

CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching

6.3 Medium

CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching. Attackers controlling a host such as one ending in a victim domain suffix, or sending Set-Cookie Domain values for unrelated hosts, can steal session cookies or inject cookies into shared client cookie jars.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.18%Unchanged since Oct 31, 2026

What each source reports

CVE List Score used 6.3

CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching

Record: CVE-2026-119416
CVSS 4.0: 6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-346
Updated: 2026-11-05

EUVDEUVD-2026-113796 6.3

Record: EUVD-2026-113796
CVSS 4.0: 6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-05

GitHub AdvisoriesGHSA-g3vg-xwg9-qrvh 6.3

CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http...

Record: GHSA-g3vg-xwg9-qrvh
CVSS 4.0: 6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-346
Updated: 2026-11-02

NVD 6.3

Record: CVE-2026-119416
CVSS 4.0: 6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-346
Updated: 2026-11-05

OSV 6.3

CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching

Record: CVE-2026-119416
CVSS 4.0: 6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-346
Updated: 2026-11-07

OSVUBUNTU-CVE-2026-119416 6.3

Record: UBUNTU-CVE-2026-119416
CVSS 4.0: 6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated: 2026-11-05

OSVCLSA-2026-1793803616 No score

TuxCare security update for cakephp/cakephp (5 CVEs)

TuxCare rebuilt cakephp/cakephp to address 5 CVEs. Fixed in 5.0.11-p2+tuxcare.

Record: CLSA-2026-1793803616
Updated: 2026-11-04

Affected products

cakephp

Affected packages

Affected packages
Package	Affected	Fixed
`cakephp/cakephp` TuxCare:Packagist From an advisory covering 5 CVEs	5.0.11 up to 5.0.11-p2+tuxcare, plus listed versions 5.0.11-p1+tuxcare	5.0.11-p2+tuxcare
`cakephp` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 2.7.2-12.8.0-12.8.0-1ubuntu0.1~esm1	None known
`cakephp` Ubuntu:20.04:LTS	All versions, plus listed versions 2.10.11-2	None known
`cakephp` Ubuntu:22.04:LTS	All versions, plus listed versions 2.10.11-2.12.10.24-1	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts	NVD
Nov 5, 2026	references	CVE List, EUVD, OSV
Nov 4, 2026	affected, aliases, facts	OSV
Nov 4, 2026	affected, aliases, facts, references	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-119416 is a medium vulnerability (CVSS 6.3) in Cakephp, published October 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 6th percentile. No source names a fixed version.

References

Show 8 moreShow less