Reliance on Cookies without Validation and Integrity Checking in Ktor - CVE-2026-123319
Published: November 6, 2026
Vulnerability identifier: #VU159680
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-123319
CWE-ID: CWE-565
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to inject cookies into client cookie storage in violation of intended domain restrictions.
The vulnerability exists due to missing validation of cookie Domain attributes in Ktor client cookie storage when processing cookies. A remote attacker can supply crafted cookies with inappropriate Domain attributes to inject cookies outside their intended domain scope.
Affected software
Ktor
How to mitigate CVE-2026-123319
Install security update from vendor's website.
Ktor - update to 3.6.1