CVE-2026-11956CWE-1004CWE-614

TwiN gatus OIDC Session Cookie oidc.go setSessionCookie missing secure attribute

Medium · published June 11, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
8.3
In the wild
Unconfirmed
What it is

A vulnerability was determined in TwiN gatus 5.36.0. Impacted is the function setSessionCookie of the file security/oidc.go of the component OIDC Session Cookie Handler. Executing a manipulation can lead to sensitive cookie without secure attribute. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The reported GitHub issue was closed with the label "not planned".

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
EPSS
0.00191 · 8.3th percentile
Weaknesses
CWE-1004 · Sensitive Cookie Without 'HttpOnly' Flag; CWE-614 · Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Published
2026-06-11T11:30Z
EPSS history
Timeline
  • 11 JUN 11:30Z
    TwiN gatus OIDC Session Cookie oidc.go setSessionCookie missing secure attribute
    cvelistv5