CVE-2026-69214: Http4s CookieJar Auth Bypass Vulnerability

CVE-2026-69214 Overview

CVE-2026-69214 affects http4s, a Scala interface for HTTP services. The CookieJar client middleware fails to validate that a response cookie's Domain attribute matches the host that supplied the cookie. A malicious or compromised server reachable through the same CookieJar instance can plant a cookie scoped to an unrelated domain. The jar later transmits that cookie to the victim domain, enabling session fixation [CWE-384] or overwriting security-sensitive cookies. The issue is fixed in versions 0.23.35 and 1.0.0-M47.

Critical Impact
Attackers who control any host contacted by a shared CookieJar can inject cookies into unrelated domains, hijacking authenticated sessions or overwriting security-sensitive cookies on the victim origin.

Affected Products

http4s versions prior to 0.23.35
http4s 1.0.0 milestone releases prior to 1.0.0-M47
Applications using the org.http4s.client.middleware.CookieJar client middleware

Discovery Timeline

2026-09-15 - CVE-2026-69214 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-69214

Vulnerability Analysis

The CookieJar middleware in http4s stores cookies returned by servers so they can be replayed on subsequent requests. When processing a Set-Cookie response header, the middleware reads the Domain attribute and stores the cookie under that domain without any relationship check to the response origin. A malicious server that a client legitimately contacts through the shared jar can therefore return a cookie whose Domain attribute points to an unrelated victim domain. The next request the client makes to the victim domain will include the attacker-supplied cookie.

This behavior enables session fixation, where the attacker chooses the session identifier that the victim's client will later present as authenticated. It also allows overwriting __Host- style or CSRF-protection cookies on the victim origin, weakening defenses that rely on cookie integrity.

Root Cause

The root cause is missing domain-match validation in extractFromResponseCookie within CookieJar.scala. The previous logic accepted c.domain verbatim and only fell back to uri.host when no Domain attribute was present. RFC 6265 requires that a server-provided Domain attribute must domain-match the request host; http4s omitted this check.

Attack Vector

The attack requires the victim client to use a shared CookieJar across multiple hosts and to contact an attacker-controlled or compromised server. The attacker responds with a Set-Cookie header whose Domain attribute targets a victim domain that the same client will later request. No user interaction is required beyond the client making normal outbound requests.

scala

// Patch: client/shared/src/main/scala/org/http4s/client/middleware/CookieJar.scala
private[middleware] def extractFromResponseCookie(
    m: Map[CookieKey, CookieValue]
)(c: ResponseCookie, httpDate: HttpDate, uri: Uri): Map[CookieKey, CookieValue] = {
  val storedDomain = c.domain match {
    case Some(d) =>
      if (uri.host.exists(domainMatches(_, d))) Some(d) else None
    case None =>
      uri.host.map(_.value)
  }
  storedDomain match {
    case Some(domainS) =>
      val key = CookieKey(c.name, domainS, c.path)
      val newCookie = c.copy(domain = domainS.some)
      // ...
  }
}

Source: http4s commit 87535f7. The patch introduces a domainMatches check between the response uri.host and the server-supplied Domain attribute, discarding non-matching cookies. Public-suffix rejection remains unimplemented, so cookies scoped to entries such as co.uk are still accepted.

Detection Methods for CVE-2026-69214

Indicators of Compromise

Outbound HTTP responses containing Set-Cookie headers whose Domain attribute does not match the response host.
Unexpected session identifiers appearing in cookies sent to authenticated services from a client using http4s CookieJar.
Repeated requests to attacker-controlled hosts immediately preceded or followed by anomalous cookie values on unrelated destinations.

Detection Strategies

Perform a dependency inventory across Scala services to identify http4s versions below 0.23.35 and 1.0.0-M47 that instantiate CookieJar.
Enable request/response logging for http4s clients in non-production environments to observe cross-domain cookie planting attempts.
Add unit tests that simulate a rogue upstream returning a Set-Cookie with a foreign Domain and confirm the cookie is rejected.

Monitoring Recommendations

Alert on outbound HTTP client logs where the stored cookie domain differs from the response origin.
Monitor authenticated session anomalies such as sudden session identifier changes for service accounts using http4s clients.
Track dependency updates in build manifests (build.sbt, Cargo.lock-style lockfiles) for http4s version pins.

How to Mitigate CVE-2026-69214

Immediate Actions Required

Upgrade http4s to 0.23.35 on the 0.23.x line or 1.0.0-M47 on the 1.0.0 milestone line.
Audit application code for direct or transitive use of org.http4s.client.middleware.CookieJar.
Where feasible, scope each CookieJar instance to a single trusted host until the upgrade is deployed.

Patch Information

The fix is available in http4s v0.23.35 and http4s v1.0.0-M47. Full technical details are documented in GitHub Security Advisory GHSA-wv64-j4fq-5f9x. Note that public-suffix rejection is not implemented by the patch; operators should treat cookies scoped to broad suffixes as untrusted.

Workarounds

Avoid sharing a single CookieJar across requests to untrusted or third-party hosts.
Wrap the client middleware with a custom filter that strips Set-Cookie headers whose Domain attribute does not equal the response host.
Reject or sanitize cookies whose Domain attribute maps to a public suffix such as com, co.uk, or github.io.

bash

# Example sbt dependency update
libraryDependencies += "org.http4s" %% "http4s-client" % "0.23.35"
# or for the 1.0 milestone line
libraryDependencies += "org.http4s" %% "http4s-client" % "1.0.0-M47"