Executive brief
TwiN Gatus is a health dashboard used by developers to monitor service availability and performance. A security flaw in its authentication system fails to properly protect session cookies, potentially allowing an attacker to steal a user's session if the dashboard is accessed over an unencrypted connection or if the attacker can run malicious scripts on the page. This could lead to unauthorized access to internal monitoring data and service status information.
Technical details
A vulnerability exists in the OIDC Session Cookie Handler of TwiN Gatus 5.36.0. The 'setSessionCookie' function in 'security/oidc.go' fails to apply the 'HttpOnly' and 'Secure' flags when generating persistent session cookies. This root cause allows the session ID to be accessible via client-side JavaScript (CWE-1004) and transmitted over unencrypted HTTP connections (CWE-614). An attacker could exploit this via network interception (e.g., SSL stripping) or in conjunction with a Cross-Site Scripting (XSS) vulnerability to hijack user sessions. The issue was reported to the maintainers but closed as 'not planned,' meaning no official patch is currently available.
Affected products
- TwiN Gatus 5.36.0
Timeline
- 2026-06-06: disclosed: GitHub issue #1689 opened reporting the vulnerability
- 2026-06-11: advisory: CVE-2026-11956 published
- 2026-06-11: other: GitHub issue closed as 'not planned' by maintainers