CVE-2026-56813: Elixir Plug Auth Bypass Vulnerability

CVE-2026-56813 Overview

CVE-2026-56813 is a cookie attribute injection vulnerability in the elixir-plug Plug library, a foundational HTTP middleware used in Elixir web frameworks such as Phoenix. The flaw resides in Plug.Conn.Cookies.encode/2 within lib/plug/conn/cookies.ex, which interpolates cookie values and attributes into the Set-Cookie header without neutralizing the ; delimiter. Applications that place attacker-controlled data into a cookie value or attribute using Plug.Conn.put_resp_cookie/4 allow attackers to inject or override cookie attributes. This weakness is classified under [CWE-141: Improper Neutralization of Parameter/Argument Delimiters].

Critical Impact
Attackers can inject ; characters to append or override cookie attributes, enabling cookie tossing, session fixation, and removal of Secure or HttpOnly flags.

Affected Products

elixir-plug/plug versions 0.1.0 through 1.16.5
elixir-plug/plug versions 1.17.0 through 1.17.3, 1.18.0 through 1.18.4, 1.19.0 through 1.19.4
elixir-plug/plug versions 1.20.0 through 1.20.2

Discovery Timeline

2026-07-10 - CVE-2026-56813 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-56813

Vulnerability Analysis

The Plug library builds the Set-Cookie HTTP response header by directly interpolating the cookie value along with its path, domain, same_site, and :extra attributes into the header string. The encode/2 function does not sanitize or reject the semicolon character (;), which serves as the delimiter between cookie attributes in the HTTP cookie specification. When an application reflects user-supplied input into a cookie value or attribute, an attacker can supply data containing ; followed by additional attributes.

Carriage return, line feed, and null bytes are still rejected by Plug.Conn header validation, so HTTP response splitting remains blocked. However, attribute injection through ; was not prevented. The consequences include cookie tossing attacks by injecting Domain or Path scopes, session fixation, and downgrade attacks by omitting the Secure and HttpOnly flags on cookies the application intended to protect.

Root Cause

The root cause is missing input validation in the cookie serialization routine. Attribute values controlled by application code, and transitively by user input, are concatenated into the Set-Cookie header without checking for the reserved delimiter ;. The fix introduces an @invalid_cookie_field list containing ";" and raises when such characters are present in cookie attributes.

Attack Vector

Exploitation requires an application to pass attacker-influenced data into a cookie value or the :extra, :path, or :domain option of Plug.Conn.put_resp_cookie/4. A common pattern is reflecting a username or user preference into a personalization cookie. The attacker supplies a payload such as value; Domain=victim.example; Path=/, which appends attributes overriding the intended cookie scope.

text

     * `:secure` - if the cookie must be sent only over https. Defaults
       to true when the connection is HTTPS
     * `:extra` - string to append to cookie. Use this to take advantage of
-      non-standard cookie attributes.
+      non-standard cookie attributes. Since this option may append multiple
+      attributes, callers must not pass user input. If user input must be
+      passed, callers must validate it against semicolon (`;`).
     * `:sign` - when true, signs the cookie
     * `:encrypt` - when true, encrypts the cookie
     * `:same_site` - set the cookie SameSite attribute to a string value.

Source: GitHub Commit c6575800

text

   Conveniences for encoding and decoding cookies.
   """
 
+  @invalid_cookie_field [";"]
+
   @doc false
   def sign_or_encrypt(%Plug.Conn{} = conn, key, value, opts) do
     {sign?, opts} = Keyword.pop(opts, :sign, false)

Source: GitHub Commit c6575800

Detection Methods for CVE-2026-56813

Indicators of Compromise

Set-Cookie response headers containing unexpected Domain, Path, or attribute overrides that duplicate or conflict with server-intended values.
Cookie values in outbound responses containing embedded ; characters followed by attribute-like tokens such as Domain=, Path=, Secure, or HttpOnly.
Session anomalies where clients present cookies scoped to broader domains or paths than the application configured.

Detection Strategies

Inspect application source for calls to Plug.Conn.put_resp_cookie/4 where the value, :extra, :path, or :domain options receive user-controlled data.
Deploy a reverse proxy or WAF rule that flags outbound Set-Cookie headers containing more attribute separators than expected.
Audit dependency manifests (mix.exs, mix.lock) for plug versions preceding the patched releases.

Monitoring Recommendations

Log full Set-Cookie headers at the edge and alert on anomalous attribute counts or duplicated attribute keys.
Monitor authentication logs for sudden shifts in cookie Domain scope or unexpected session identifiers reused across subdomains.
Track upgrades of the plug dependency across build pipelines to confirm remediation coverage.

How to Mitigate CVE-2026-56813

Immediate Actions Required

Upgrade plug to a fixed release: 1.16.6, 1.17.4, 1.18.5, 1.19.5, or 1.20.3, whichever matches your current major line.
Review all invocations of Plug.Conn.put_resp_cookie/4 and remove or validate any path where user input flows into cookie values or attributes.
Rotate active session cookies after upgrading if the application previously reflected user-controlled data into cookies.

Patch Information

The upstream fix in commit c6575800b2c4e15af1904df87522ca8a23da020c adds an @invalid_cookie_field list containing ";" and raises when semicolons appear in cookie attributes. Fixed versions are 1.16.6, 1.17.4, 1.18.5, 1.19.5, and 1.20.3. See the GitHub Security Advisory GHSA-wpmj-jh88-rpgm and the OSV Vulnerability Report for full details.

Workarounds

Validate and reject any user input containing ; before passing it to Plug.Conn.put_resp_cookie/4 or its :extra option.
Store user-controlled data server-side and reference it by an opaque, server-generated identifier placed in the cookie.
Enforce strict allowlists for cookie values, such as alphanumeric characters only, when reflecting user data.

bash

# Update Plug to a patched version in mix.exs
# {:plug, "~> 1.20.3"}
mix deps.update plug
mix deps.get
mix compile