TLS cookie without secure flag set
Summary: PortSwigger Research describes a cookie that carries the TLS name but lacks the secure flag, so browsers will send it in clear text over any unencrypted HTTP request within the cookie's scope. An attacker positioned to eavesdrop on the victim's traffic can induce that request with crafted links, including links of the form http://example.com:443/, even when the issuing domain hosts no HTTP content.
What's compelling: Exploiting this requires only a position on the network path - public Wi-Fi, a shared corporate or home network with a compromised machine, or an ISP - and switched networks are not sufficient to stop it, so a session token sent once in clear text is exposed to anyone sitting on that path.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026