Password value set in cookie
Summary: PortSwigger Research describes applications that issue a cookie containing the clear-text value of the password a user supplied. The write-up notes that any cookie-stealing vulnerability in the application or browser would then let an attacker take the user's credentials, and that applications should not store user credentials in any client-side mechanism such as cookies.
What you should know: A stolen cookie here is not a session token but the password itself, and the resulting compromise is described as extremely difficult to investigate because audit trails are obscured. Users who reused that password elsewhere are exposed even if the application handles only non-sensitive information.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026