CVE-2026-69214: Http4s CookieJar Auth Bypass Vulnerability

CVE-2026-69214 Overview

CVE-2026-69214 affects http4s, a Scala interface for HTTP services. The CookieJar client middleware fails to validate that a response cookie's Domain attribute matches the host that supplied the cookie. A malicious or compromised server reachable through the same CookieJar instance can plant a cookie scoped to an unrelated domain. The jar later transmits that cookie to the victim domain, enabling session fixation [CWE-384] or overwriting security-sensitive cookies. The issue is fixed in versions 0.23.35 and 1.0.0-M47.

Critical Impact

Attackers who control any host contacted by a shared CookieJar can inject cookies into unrelated domains, hijacking authenticated sessions or overwriting security-sensitive cookies on the victim origin.

Affected Products

• http4s versions prior to 0.23.35
• http4s 1.0.0 milestone releases prior to 1.0.0-M47
• Applications using the org.http4s.client.middleware.CookieJar client middleware

Discovery Timeline

• 2026-09-15 - CVE-2026-69214 published to NVD
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-69214

Vulnerability Analysis

The CookieJar middleware in http4s stores cookies returned by servers so they can be replayed on subsequent requests. When processing a Set-Cookie response header, the middleware reads the Domain attribute and stores the cookie under that domain without any relationship check to the response origin. A malicious server that a client legitimately contacts through the shared jar can therefore return a cookie whose Domain attribute points to an unrelated victim domain. The next request the client makes to the victim domain will include the attacker-supplied cookie.

This behavior enables session fixation, where the attacker chooses the session identifier that the victim's client will later present as authenticated. It also allows overwriting __Host- style or CSRF-protection cookies on the victim origin, weakening defenses that rely on cookie integrity.

Root Cause

The root cause is missing domain-match validation in extractFromResponseCookie within CookieJar.scala. The previous logic accepted c.domain verbatim and only fell back to uri.host when no Domain attribute was present. RFC 6265 requires that a server-provided Domain attribute must domain-match the request host; http4s omitted this check.

Attack Vector

The attack requires the victim client to use a shared CookieJar across multiple hosts and to contact an attacker-controlled or compromised server. The attacker responds with a Set-Cookie header whose Domain attribute targets a victim domain that the same client will later request. No user interaction is required beyond the client making normal outbound requests.

// Patch: client/shared/src/main/scala/org/http4s/client/middleware/CookieJar.scala
private[middleware] def extractFromResponseCookie(
    m: Map[CookieKey, CookieValue]
)(c: ResponseCookie, httpDate: HttpDate, uri: Uri): Map[CookieKey, CookieValue] = {
  val storedDomain = c.domain match {
    case Some(d) =>
      if (uri.host.exists(domainMatches(_, d))) Some(d) else None
    case None =>
      uri.host.map(_.value)
  }
  storedDomain match {
    case Some(domainS) =>
      val key = CookieKey(c.name, domainS, c.path)
      val newCookie = c.copy(domain = domainS.some)
      // ...
  }
}

Source: http4s commit 87535f7. The patch introduces a domainMatches check between the response uri.host and the server-supplied Domain attribute, discarding non-matching cookies. Public-suffix rejection remains unimplemented, so cookies scoped to entries such as co.uk are still accepted.

Detection Methods for CVE-2026-69214

Indicators of Compromise

• Outbound HTTP responses containing Set-Cookie headers whose Domain attribute does not match the response host.
• Unexpected session identifiers appearing in cookies sent to authenticated services from a client using http4s CookieJar.
• Repeated requests to attacker-controlled hosts immediately preceded or followed by anomalous cookie values on unrelated destinations.

Detection Strategies

• Perform a dependency inventory across Scala services to identify http4s versions below 0.23.35 and 1.0.0-M47 that instantiate CookieJar.
• Enable request/response logging for http4s clients in non-production environments to observe cross-domain cookie planting attempts.
• Add unit tests that simulate a rogue upstream returning a Set-Cookie with a foreign Domain and confirm the cookie is rejected.

Monitoring Recommendations

• Alert on outbound HTTP client logs where the stored cookie domain differs from the response origin.
• Monitor authenticated session anomalies such as sudden session identifier changes for service accounts using http4s clients.
• Track dependency updates in build manifests (build.sbt, Cargo.lock-style lockfiles) for http4s version pins.

How to Mitigate CVE-2026-69214

Immediate Actions Required

• Upgrade http4s to 0.23.35 on the 0.23.x line or 1.0.0-M47 on the 1.0.0 milestone line.
• Audit application code for direct or transitive use of org.http4s.client.middleware.CookieJar.
• Where feasible, scope each CookieJar instance to a single trusted host until the upgrade is deployed.

Patch Information

The fix is available in http4s v0.23.35 and http4s v1.0.0-M47. Full technical details are documented in GitHub Security Advisory GHSA-wv64-j4fq-5f9x. Note that public-suffix rejection is not implemented by the patch; operators should treat cookies scoped to broad suffixes as untrusted.

Workarounds

• Avoid sharing a single CookieJar across requests to untrusted or third-party hosts.
• Wrap the client middleware with a custom filter that strips Set-Cookie headers whose Domain attribute does not equal the response host.
• Reject or sanitize cookies whose Domain attribute maps to a public suffix such as com, co.uk, or github.io.

# Example sbt dependency update
libraryDependencies += "org.http4s" %% "http4s-client" % "0.23.35"
# or for the 1.0 milestone line
libraryDependencies += "org.http4s" %% "http4s-client" % "1.0.0-M47"