Duplicate cookies set
Summary: PortSwigger Research describes a scanner finding in which a response contains two or more Set-Cookie headers that set the same cookie to different values. Browsers accept only one of these values, typically the one in the last header, and the duplicate headers may indicate a programming error.
Bottom line: When a response sets the same cookie twice with different values, the browser keeps only the last one, so the value your application intended may silently lose to another - a discrepancy an attacker can exploit if the two values differ in privilege or scope.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026