CVE-2026-32745
Medium · 6.3CVSS
6.3
EPSS
0.2%
Published
Mar 13, 2026
CISA due date
—
The record
In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-65655 When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy… CWE-614
- CVE-2026-46550 NocoDB is software for building databases as spreadsheets. CWE-614
- CVE-2026-53661 Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid… CWE-614
- CVE-2026-11956 A vulnerability was determined in TwiN gatus 5.36.0. CWE-614
- CVE-2026-46398 HAX CMS helps manage microsite universe with PHP or NodeJs backends. CWE-614
- CVE-2025-52608 HCL iControl was affected by Missing Cookie Attributes vulnerability. CWE-614
- CVE-2026-41017 Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure`… CWE-614
- CVE-2026-43828 Default configurations of Apache Shiro send sensitive cookies in HTTPS session without… CWE-614