CVE-2025-52608
Low · 3.1CVSS
3.1
EPSS
0.1%
Published
Jun 4, 2026
CISA due date
—
The record
HCL iControl was affected by Missing Cookie Attributes vulnerability. It was observed that the application is missing several critical cookie attributes, including Secure and SameSite. And also path is set to root.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-65655 When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy… CWE-614
- CVE-2026-46550 NocoDB is software for building databases as spreadsheets. CWE-614
- CVE-2026-53661 Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid… CWE-614
- CVE-2026-11956 A vulnerability was determined in TwiN gatus 5.36.0. CWE-614
- CVE-2026-46398 HAX CMS helps manage microsite universe with PHP or NodeJs backends. CWE-614
- CVE-2026-41017 Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure`… CWE-614
- CVE-2026-43828 Default configurations of Apache Shiro send sensitive cookies in HTTPS session without… CWE-614
- GHSA-f74w-272x-mqcv NocoDB: Refresh Token Cookie Set Without `secure` and `sameSite` Flags CWE-614