CWEweakness
CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
- Abstraction
- Variant
- Structure
- Simple
- Status
- Draft
- CWE version
- 5.0
Description
The Secure attribute for sensitive cookies in HTTPS sessions is not set.
Common consequences
• Confidentiality: Read Application Data — Omitting the secure flag makes it possible for the user agent to send the cookies in plaintext over an HTTP session.
Potential mitigations
• [Implementation] Always set the secure attribute when the cookie should be sent via HTTPS only.
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Observed examples
• CVE-2024-47833: python library for ML and data science does not use the Secure flag (CWE-614) or HTTPOnly security attribute (CWE-1004) for session cookies.
• CVE-2004-0462: A product does not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in plaintext over an HTTP session with the product.
• CVE-2008-3663: A product does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
• CVE-2008-3662: A product does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
• CVE-2008-0128: A product does not set the secure flag for a cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
Related
Attack pattern · CAPEC (1)
- CAPEC-102 Session Sidejacking attack pattern
Observed example · CVE (5)
- CVE-2024-47833 Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. vulnerability
- CVE-2008-3663 Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http… vulnerability
- CVE-2008-3662 Gallery before 1.5.9, and 2.x before 2.2.6, does not set the secure flag for the session cookie in an https session, which can cause the… vulnerability
- CVE-2008-0128 The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the… vulnerability
- CVE-2004-0462 The built-in web servers for multiple networking devices do not set the Secure attribute for sensitive cookies in HTTPS sessions, which… vulnerability
Child of · CWE (1)
- CWE-319 Cleartext Transmission of Sensitive Information weakness
Referenced by CAPEC · weakness (1)
- CAPEC-102 Session Sidejacking attack pattern
Referenced by CVE · weakness (68)
- CVE-2026-115519 Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to… vulnerability
- CVE-2026-56599 HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to… vulnerability
- CVE-2026-66249 iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies transmitted over… vulnerability
- CVE-2026-65655 When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server… vulnerability
- CVE-2026-15656 IBM Maximo Application Suite 9.2, 9.1, and 9.0 does not set the secure attribute on authorization tokens or session cookies. vulnerability
- CVE-2026-48058 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. vulnerability
- CVE-2026-56581 HCL MyCloud was affected with Cookie Attribute Path Not Set. vulnerability
- CVE-2024-23572 HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which may increase the risk associated with this… vulnerability
- CVE-2026-57948 Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt… vulnerability
- CVE-2026-46550 NocoDB is software for building databases as spreadsheets. vulnerability
- CVE-2026-11956 A vulnerability was determined in TwiN gatus 5.36.0. vulnerability
- CVE-2026-53661 Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. vulnerability
- CVE-2026-46398 HAX CMS helps manage microsite universe with PHP or NodeJs backends. vulnerability
- CVE-2025-52608 HCL iControl was affected by Missing Cookie Attributes vulnerability. vulnerability
- CVE-2026-41017 Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure` flag, so deployments running the Airflow API server… vulnerability
- CVE-2026-43828 Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. vulnerability
- CVE-2026-22617 Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attacker to intercept the… vulnerability
- CVE-2026-4820 IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. vulnerability
- CVE-2026-32745 In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings vulnerability
- CVE-2026-1697 The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web app of PcVue in version 12.0.0 through… vulnerability
- CVE-2024-58317 A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL requirements when setting administration… vulnerability
- CVE-2025-36249 IBM Jazz for Service Management 1.1.3.0 through 1.1.3.25 does not set the secure attribute on authorization tokens or session cookies. vulnerability
- CVE-2025-52614 HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability. vulnerability
- CVE-2025-52632 A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue affects AION: 2.0. vulnerability
- CVE-2025-36011 IBM Jazz for Service Management 1.1.3.0 through 1.1.3.24 does not set the secure attribute on authorization tokens or session cookies. vulnerability
- CVE-2025-8037 Setting a nameless cookie with an equals sign in the value shadowed other cookies. vulnerability
- CVE-2025-53757 This vulnerability exists in Digisol DG-GR6821AC Router due to misconfiguration of both Secure and HttpOnly flags on session cookies… vulnerability
- CVE-2025-27450 The Secure attribute is missing on multiple cookies provided by the MEAC300-FNADE4. vulnerability
- CVE-2025-36026 IBM Datacap 9.1.7, 9.1.8, and 9.1.9 does not set the secure attribute on authorization tokens or session cookies. vulnerability
- CVE-2024-10718 In phpipam/phpipam version 1.5.1, the Secure attribute for sensitive cookies in HTTPS sessions is not set. vulnerability