# CVE-2026-119416: CakePHP improper cookie domain validation in Http Client

Source: https://junglewise.ai/threats/cve-2026-119416-cakephp-through-5-4-3-contains-an-improper-cookie-domain  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119416 · Severity: medium · CVSS 4.8 · Published 2026-10-30

CakePHP, a web development framework for PHP, uses improper validation when accepting cookies from servers in its Http Client component. An attacker controlling a host with a name matching a victim's domain suffix, or sending malicious Set-Cookie Domain headers, can steal session cookies or inject unauthorized cookies into shared client cookie jars, potentially compromising user sessions or poisoning application behavior.

Technologies: [Cakephp](https://junglewise.ai/threats/technologies/cakephp). Vendors: [Cakephp](https://junglewise.ai/threats/vendors/cakephp).

## Quick answers

**Is CVE-2026-119416 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119416 being exploited in the wild.

**How severe is CVE-2026-119416?** Medium severity, with a CVSS score of 4.8, published 30 October 2026.

**Which products and versions are affected?** Cakephp through 5.4.3.

**Is there a fix for CVE-2026-119416?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-119416 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-119416?** Check whether you run Cakephp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper cookie domain validation flaw in the Http Client CookieCollection class that uses unanchored suffix matching rather than proper domain validation. An attacker controlling a host (e.g., one ending in a victim domain suffix) or sending Set-Cookie Domain values for unrelated hosts can exploit this to inject or steal cookies. The attack requires network interaction with the vulnerable client making HTTP requests to attacker-controlled or compromised servers.

## Affected products

- CakePHP CakePHP through 5.4.3

## Timeline

- 2026-10-30: disclosed

## References

- [https://abraxaslabs.tech/research/cakephp-cookie-suffix](https://abraxaslabs.tech/research/cakephp-cookie-suffix)
- [https://github.com/cakephp/cakephp](https://github.com/cakephp/cakephp)

## Related threats

- [CakePHP SQL injection in collation handling](https://junglewise.ai/threats/cve-2026-119419-cakephp-through-5-4-3-contains-an-sql-injection-vulnerability)
- [CakePHP SQL injection in WindowExpression](https://junglewise.ai/threats/cve-2026-119418-cakephp-through-5-4-3-contains-an-sql-injection-vulnerability)
- [CakePHP CakeResponse download method header injection and XSS](https://junglewise.ai/threats/cve-2026-106512-the-cakeresponse-download-method-in-lib-cake-network)
- [CakePHP FunctionsBuilder SQL injection in multiple methods](https://junglewise.ai/threats/cve-2026-79752-cakephp-functionsbuilder-sql-injection-in-multiple-methods)
- [CakePHP FunctionsBuilder::jsonValue SQL injection with PostgresDriver](https://junglewise.ai/threats/cve-2026-77635-cakephp-functionsbuilder-jsonvalue-sql-injection-with)