CVE-2026-55688: AsyncHttpClient Auth Bypass Vulnerability

CVE-2026-55688 Overview

CVE-2026-55688 is a cookie injection vulnerability in the AsyncHttpClient (AHC) library for Java. The ThreadSafeCookieStore component stored cookies using the Domain attribute without verifying that the responding host was authorized to set cookies for that domain. An attacker-controlled host can plant a cookie scoped to an unrelated trusted domain, and the client will subsequently send that cookie on requests to that trusted domain. Applications that use a single shared AsyncHttpClient instance to reach both an attacker-influenced host and a trusted host are affected. The flaw is tracked as CWE-1275: Sensitive Cookie with Improper SameSite Attribute and impacts versions 2.0.0 through 2.15.x and 3.0.0.Beta1 through 3.0.10.

Critical Impact
A malicious host reachable by the client can inject cookies scoped to a trusted third-party domain, enabling session fixation or integrity attacks on downstream requests.

Affected Products

AsyncHttpClient (AHC) library versions 2.0.0 to 2.16.0 (exclusive)
AsyncHttpClient (AHC) library versions 3.0.0.Beta1 to 3.0.11 (exclusive)
Java applications sharing a single AsyncHttpClient instance and default CookieStore across multiple hosts

Discovery Timeline

2026-07-01 - CVE-2026-55688 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-55688

Vulnerability Analysis

AsyncHttpClient is a widely used Java HTTP client library that executes HTTP requests asynchronously. The ThreadSafeCookieStore class manages cookies across requests when a client instance is reused. When a server response includes a Set-Cookie header with a Domain attribute, the store indexes and later retrieves the cookie using that attribute value verbatim.

The implementation did not compare the Domain attribute against the host that issued the Set-Cookie header. RFC 6265 requires rejecting cookies whose Domain does not domain-match the origin host. Skipping this check allows a host to set cookies for arbitrary domains, a class of attack known as cookie tossing or cookie injection.

Root Cause

The root cause is missing origin validation in the cookie storage logic of ThreadSafeCookieStore. The store trusted the Domain attribute supplied by the responding host without confirming that the host was permitted to issue cookies for that domain, violating RFC 6265 domain-matching rules.

Attack Vector

An attacker who controls or influences one host the client contacts returns a Set-Cookie header specifying the Domain attribute of an unrelated trusted target. The shared CookieStore records the cookie under the attacker-chosen domain. On the next request to the trusted host, the client attaches the injected cookie, which the trusted server processes as legitimate. This can enable session fixation, authentication state manipulation, or bypass of anti-CSRF cookie patterns. Exploitation requires the target application to share a single client instance across trusted and untrusted hosts. Refer to the GitHub Security Advisory GHSA-m452-q8c9-rg2f for further technical detail.

Detection Methods for CVE-2026-55688

Indicators of Compromise

Outbound HTTP requests carrying cookies that were not previously issued by the destination host during the current session
Set-Cookie response headers from third-party or user-controlled hosts specifying a Domain attribute belonging to an unrelated trusted domain
Application logs showing unexpected session identifiers or authentication cookies attached to requests toward internal or partner APIs

Detection Strategies

Perform a software composition analysis (SCA) scan of Java build manifests (pom.xml, build.gradle) to identify org.asynchttpclient:async-http-client versions below 2.16.0 or 3.0.11
Instrument HTTP client wrappers to log cookie origin versus request destination and alert on domain mismatches
Review dependency lockfiles across CI/CD pipelines for vulnerable AsyncHttpClient releases

Monitoring Recommendations

Monitor egress traffic for unexpected Set-Cookie headers containing cross-domain Domain attributes
Correlate outbound API calls with cookie provenance in application telemetry
Track dependency updates for AsyncHttpClient in SBOM inventories and flag deployments still using vulnerable versions

How to Mitigate CVE-2026-55688

Immediate Actions Required

Upgrade AsyncHttpClient to version 2.16.0 for the 2.x branch or 3.0.11 for the 3.x branch
Audit application code for shared AsyncHttpClient instances that reach both trusted and untrusted hosts
Isolate client instances by trust boundary so untrusted destinations do not share a CookieStore with trusted destinations

Patch Information

The fix is implemented in GitHub Pull Request #2196 and shipped in AsyncHttpClient 2.16.0 and 3.0.11. The patched ThreadSafeCookieStore verifies that the responding host is permitted to set a cookie for the specified Domain attribute before persisting the cookie.

Workarounds

Disable the shared cookie store by configuring AsyncHttpClientConfig with a null or per-request CookieStore when upgrading is not immediately feasible
Create separate AsyncHttpClient instances for each distinct trust domain to prevent cross-domain cookie tossing
Implement a custom CookieStore wrapper that enforces RFC 6265 domain-matching before accepting a cookie

bash

# Maven dependency upgrade example
# Update pom.xml to a fixed release
<dependency>
    <groupId>org.asynchttpclient</groupId>
    <artifactId>async-http-client</artifactId>
    <version>3.0.11</version>
</dependency>

# Or for the 2.x branch
# <version>2.16.0</version>