# CWE-1275.

Every Advisory and CVE whose sources give the weakness CWE-1275, newest first.

## Records, newest first

- [WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes](https://agentprime.io/advisories/CVE-2026-78188.md)
  `CVE-2026-78188` · CVE record · No CVSS score · Not analysed yet · Published 31 Oct 2026 · Tags: CWE-614, CWE-1004, CWE-1275
- [AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk](https://agentprime.io/advisories/GHSA-f9m8-cv68-674w.md)
  `GHSA-f9m8-cv68-674w`, `CVE-2026-107280` · Maven `org.asynchttpclient:async-http-client`: affected `>=3.0.0, <3.0.13 || >=2.0.0, <2.16.1`, fixed in `3.0.13`, `2.16.1` · CVSS 6.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-1275
- [AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts](https://agentprime.io/advisories/CVE-2026-107229.md)
  `CVE-2026-107229` · CVE record: AsyncHttpClient async-http-client · CVSS 4.0 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass, CWE-1275
- [Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState](https://agentprime.io/advisories/GHSA-phg3-3g28-wq9v.md)
  `GHSA-phg3-3g28-wq9v`, `CVE-2026-61687`, `GO-2026-6535` · Go `github.com/hatchet-dev/hatchet`: affected `<0.91.1`, fixed in `0.91.1` · CVSS 7.1 High · Not analysed yet · Published 21 Sept 2026 · Tags: Authentication bypass, Cross-site request forgery (CSRF), CWE-1275
- [Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin](https://agentprime.io/advisories/GHSA-grh8-3p95-f9rr.md)
  `GHSA-grh8-3p95-f9rr`, `CVE-2026-69215` · Maven `org.http4s:http4s-client_2.12` and 2 more: affected `<0.23.35`, fixed in `0.23.35` · CVSS 6.8 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-565, CWE-1275
- [@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking](https://agentprime.io/advisories/GHSA-fm3f-ch8h-qw8q.md)
  `GHSA-fm3f-ch8h-qw8q`, `CVE-2026-81888` · npm `@hono/oauth-providers`: affected `<0.8.6`, fixed in `0.8.6` · CVSS 5.4 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site request forgery (CSRF), CWE-1275
- [Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse](https://agentprime.io/advisories/CVE-2026-47889.md)
  `CVE-2026-47889` · CVE record: Spring Spring Framework · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: CWE-1275
- [AsyncHttpClient stores cookie for an unrelated domain (cookie tossing) via ThreadSafeCookieStore](https://agentprime.io/advisories/GHSA-m452-q8c9-rg2f.md)
  `GHSA-m452-q8c9-rg2f`, `CVE-2026-55688` · Maven `org.asynchttpclient:async-http-client`: affected `>=3.0.0.Beta1, <3.0.11 || >=2.0.0, <2.16.0`, fixed in `3.0.11`, `2.16.0` · CVSS 4.0 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-1275
- [OpenAM Insecure SSO Cookie Initialization](https://agentprime.io/advisories/GHSA-fpmh-vx4h-xc33.md)
  `GHSA-fpmh-vx4h-xc33`, `CVE-2026-53660` · Maven `org.openidentityplatform.openam:openam-core`: affected `<16.1.1`, fixed in `16.1.1` · CVSS 7.4 High · Not analysed yet · Published 14 Aug 2026 · Tags: CWE-1004, CWE-1188, CWE-1275
- [Emlog: Missing CSRF protection in AI Assistant execute_tool leads to full database compromise and admin account takeover](https://agentprime.io/advisories/CVE-2026-73847.md)
  `CVE-2026-73847` · CVE record: emlog emlog · CVSS 6.8 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: Cross-site request forgery (CSRF), Hard-coded credentials, CWE-1275
- [Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder](https://agentprime.io/advisories/GHSA-xj25-753j-wgp9.md)
  `GHSA-xj25-753j-wgp9`, `CVE-2026-8415`, `PKSA-9s3m-thqq-9cfd` · Packagist `concrete5/concrete5`: affected `>=9.0.0RC1, <9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF), CWE-1275
- [Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete](https://agentprime.io/advisories/GHSA-v7c7-658v-hh7v.md)
  `GHSA-v7c7-658v-hh7v`, `CVE-2026-8410`, `PKSA-x9hx-5ky4-cyz2` · Packagist `concrete5/concrete5`: affected `>=9.0.0RC1, <9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF), CWE-1275
- [Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache](https://agentprime.io/advisories/GHSA-rv3q-xmfw-mcjv.md)
  `GHSA-rv3q-xmfw-mcjv`, `CVE-2026-8412`, `PKSA-ks9q-hdsh-jhd2` · Packagist `concrete5/concrete5`: affected `>=9.0.0RC1, <9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF), CWE-1275
- [Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id)](https://agentprime.io/advisories/GHSA-qj94-6rx6-27fr.md)
  `GHSA-qj94-6rx6-27fr`, `CVE-2026-8416`, `PKSA-4vdj-385c-kbs8` · Packagist `concrete5/concrete5`: affected `>=9.0.0RC1, <9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF), CWE-1275
- [Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design](https://agentprime.io/advisories/GHSA-mpq2-mv8p-9wm6.md)
  `GHSA-mpq2-mv8p-9wm6`, `CVE-2026-8413`, `PKSA-jszb-q2pk-2pw4` · Packagist `concrete5/concrete5`: affected `>=9.0.0RC1, <9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF), CWE-1275
- [Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate](https://agentprime.io/advisories/GHSA-98qf-jvwj-2r5f.md)
  `GHSA-98qf-jvwj-2r5f`, `CVE-2026-8414`, `PKSA-9yjm-r5x4-kcxv` · Packagist `concrete5/concrete5`: affected `>=9.0.0RC1, <9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF), CWE-1275
- [Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star()](https://agentprime.io/advisories/GHSA-97jw-gr4m-c5v8.md)
  `GHSA-97jw-gr4m-c5v8`, `CVE-2026-8432`, `PKSA-q99w-2v6k-kwsc` · Packagist `concrete5/concrete5`: affected `>=9.0.0RC1, <9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF), CWE-1275
- [Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete](https://agentprime.io/advisories/GHSA-752x-23hp-jmv6.md)
  `GHSA-752x-23hp-jmv6`, `CVE-2026-8411`, `PKSA-ngsw-3psq-jryj` · Packagist `concrete5/concrete5`: affected `>=9.0.0RC1, <9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF), CWE-1275
- [Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple()](https://agentprime.io/advisories/GHSA-6qjh-p324-694f.md)
  `GHSA-6qjh-p324-694f`, `CVE-2026-8434`, `PKSA-15g8-fcvm-qwvy` · Packagist `concrete5/concrete5`: affected `>=9.0.0RC1, <9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF), CWE-1275
- [Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan()](https://agentprime.io/advisories/GHSA-6fxm-r8p3-mx5c.md)
  `GHSA-6fxm-r8p3-mx5c`, `CVE-2026-8433`, `PKSA-1cn3-6pmf-71hx` · Packagist `concrete5/concrete5`: affected `>=9.0.0RC1, <9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF), CWE-1275
- [Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id)](https://agentprime.io/advisories/GHSA-67hj-8239-cmf5.md)
  `GHSA-67hj-8239-cmf5`, `CVE-2026-8427`, `PKSA-d6mg-vz5r-sfbf` · Packagist `concrete5/concrete5`: affected `>=9.0.0RC1, <9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF), CWE-1275
- [Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete](https://agentprime.io/advisories/GHSA-56c9-xq5g-xrf9.md)
  `GHSA-56c9-xq5g-xrf9`, `CVE-2026-8409`, `PKSA-qzg4-w3py-ddfh` · Packagist `concrete5/concrete5`: affected `>=9.0.0RC1, <9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF), CWE-1275
- [Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion()](https://agentprime.io/advisories/GHSA-44q4-354f-c826.md)
  `GHSA-44q4-354f-c826`, `CVE-2026-8435`, `PKSA-54fw-f2r8-pxcd` · Packagist `concrete5/concrete5`: affected `>=9.0.0RC1, <9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF), CWE-1275
- [Use of unsecure cookies for GraphicalData web service and WebClient web app](https://agentprime.io/advisories/CVE-2026-1697.md)
  `CVE-2026-1697` · CVE record: arcinfo PcVue · CVSS 5.3 Medium · Not analysed yet · Published 26 Feb 2026 · Tags: CWE-614, CWE-1275
- [HCL AION is susceptible to Missing SameSite vulnerability](https://agentprime.io/advisories/CVE-2025-52628.md)
  `CVE-2025-52628` · CVE record: HCL AION · CVSS 4.6 Medium · Not analysed yet · Published 3 Feb 2026 · Tags: CWE-1275
- [Kimai contains a SameSite cookie vulnerability](https://agentprime.io/advisories/GHSA-cv8h-r7r5-vwj9.md)
  `GHSA-cv8h-r7r5-vwj9`, `CVE-2023-53957`, `PKSA-kh61-fncz-s7b4` · Packagist `kimai/kimai`: affected `<=1.30.10`, no fixed version yet · CVSS 8.5 High · Not analysed yet · Published 19 Dec 2025 · Tags: CWE-1275
- [IBM Sterling B2B Integrator and IBM Sterling File Gateway information disclosure](https://agentprime.io/advisories/CVE-2025-36134.md)
  `CVE-2025-36134` · CVE record: IBM Sterling B2B Integrator and 1 more · CVSS 3.7 Low · Not analysed yet · Published 25 Nov 2025 · Tags: CWE-1275
- [HCL BigFix Compliance is affected by an improper or missing SameSite attribute](https://agentprime.io/advisories/CVE-2024-42212.md)
  `CVE-2024-42212` · CVE record: HCL Software HCL BigFix Compliance · CVSS 5.4 Medium · Not analysed yet · Published 5 May 2025 · Tags: CWE-1275
- [HCL SX is susceptible to cookie with Insecure, Improper, or Missing SameSite attribute vulnerability](https://agentprime.io/advisories/CVE-2024-30155.md)
  `CVE-2024-30155` · CVE record: HCL Software HCL SX · CVSS 5.5 Medium · Not analysed yet · Published 26 Mar 2025 · Tags: CWE-1275
- [Missing CSRF protection](https://agentprime.io/advisories/CVE-2025-24387.md)
  `CVE-2025-24387` · CVE record: OTRS AG OTRS · CVSS 4.8 Medium · Not analysed yet · Published 10 Mar 2025 · Tags: CWE-1275
- [Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes](https://agentprime.io/advisories/CVE-2025-24897.md)
  `CVE-2025-24897` · CVE record: misskey-dev misskey · CVSS 8.2 High · Not analysed yet · Published 11 Feb 2025 · Tags: Cross-site request forgery (CSRF), CWE-614, CWE-1275
- [IBM Concert information disclosure](https://agentprime.io/advisories/CVE-2024-43173.md)
  `CVE-2024-43173` · CVE record: IBM Concert · CVSS 3.7 Low · Not analysed yet · Published 22 Oct 2024 · Tags: CWE-1275
- [Incorrect handling of SameSite cookies](https://agentprime.io/advisories/CVE-2024-6611.md)
  `CVE-2024-6611` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jul 2024 · Tags: CWE-1275
- [IBM Cloud Pak for Security information disclosure](https://agentprime.io/advisories/CVE-2022-38386.md)
  `CVE-2022-38386` · CVE record: IBM Cloud Pak for Security and 1 more · CVSS 5.9 Medium · Not analysed yet · Published 1 May 2024 · Tags: CWE-1275

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-1275>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-1275/>. Everything for agents: <https://agentprime.io/llms.txt>.