CVE-2026-32745CWE-614

In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings

Medium · published March 13, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
4.7
In the wild
Unconfirmed
What it is

In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00159 · 4.7th percentile
Weakness
CWE-614 · Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Published
2026-03-13T15:50Z
EPSS history
Timeline
  • 13 MAR 15:50Z
    In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings
    cvelistv5