---
id: CVE-2026-119416
title: >-
  CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain
  Matching
summary: >-
  CakePHP through 5.4.3 contains an improper cookie domain validation
  vulnerability in the Http Client CookieCollection that allows malicious
  servers to receive and plant cookies by abusing unanchored suffix matching.
  Attackers controlling…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-346
vendor: cakephp
product: cakephp
affected:
  - cakephp <= 5.4.3
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T11:30:48.754Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119416'
references:
  - url: >-
      https://github.com/cakephp/cakephp/commit/01753266738606bc0e48e61e44a6e252f11386f9
  - url: >-
      https://github.com/cakephp/cakephp/commit/5d9d01a91f0e678d857a94115de12c3e02f3fbba
  - url: >-
      https://github.com/cakephp/cakephp/commit/bbba5ed06d5cea7e78333b01e65557cff7a28306
  - url: >-
      https://github.com/cakephp/cakephp/commit/819b45cbcc5ba864568cb57f62e4fde650b41161
  - url: 'https://github.com/cakephp/cakephp/pull/19702'
  - url: >-
      https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Http/Cookie/CookieCollection.php#L315
  - url: >-
      https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Http/Cookie/CookieCollection.php#L74
  - url: 'https://abraxaslabs.tech/research/cakephp-cookie-suffix'
  - url: 'https://github.com/cakephp/cakephp'
  - url: >-
      https://www.vulncheck.com/advisories/cakephp-through-5.4.3-cookie-leakage-via-http-client-cookiecollection-domain-matching
    label: >-
      VulnCheck Advisory: CakePHP through 5.4.3 Cookie Leakage via HTTP Client
      CookieCollection Domain Matching
tags:
  - cve.org
epss: 0.00175
epssPercentile: 0.0692
ingestedAt: '2026-11-03T10:42:03.639Z'
---

## Overview

CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching. Attackers controlling a host such as one ending in a victim domain suffix, or sending Set-Cookie Domain values for unrelated hosts, can steal session cookies or inject cookies into shared client cookie jars.

## Affected

- `cakephp <= 5.4.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.