CVE-2026-11956

The record

A vulnerability was determined in TwiN gatus 5.36.0. Impacted is the function setSessionCookie of the file security/oidc.go of the component OIDC Session Cookie Handler. Executing a manipulation can lead to sensitive cookie without secure attribute. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The reported GitHub issue was closed with the label "not planned".

Affected packages

Related vulnerabilities

• CVE-2026-65655 When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy… CWE-614
• CVE-2026-46550 NocoDB is software for building databases as spreadsheets. CWE-614
• CVE-2026-53661 Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid… CWE-614
• CVE-2026-46398 HAX CMS helps manage microsite universe with PHP or NodeJs backends. CWE-614
• CVE-2025-52608 HCL iControl was affected by Missing Cookie Attributes vulnerability. CWE-614
• CVE-2026-41017 Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure`… CWE-614
• CVE-2026-43828 Default configurations of Apache Shiro send sensitive cookies in HTTPS session without… CWE-614
• GHSA-f74w-272x-mqcv NocoDB: Refresh Token Cookie Set Without `secure` and `sameSite` Flags CWE-614