CVE-2026-11956

LOW

TwiN gatus OIDC Session Cookie oidc.go setSessionCookie missing secure attribute

Title source: cna
STIX 2.1

Description

A vulnerability was determined in TwiN gatus 5.36.0. Impacted is the function setSessionCookie of the file security/oidc.go of the component OIDC Session Cookie Handler. Executing a manipulation can lead to sensitive cookie without secure attribute. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The reported GitHub issue was closed with the label "not planned".

References (6)

Core 6
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-370343 | TwiN gatus OIDC Session Cookie oidc.go setSessionCookie missing secure attribute
https://vuldb.com/vuln/370343
Signature, Permissions Required signature permissions-required
VDB-370343 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/370343/cti
Third Party Advisory third-party-advisory
CVE-2026-11956 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-11956
Third Party Advisory third-party-advisory
Submit #836328 | TwiN gatus 5.36.0 Sensitive Cookie Without Secure Attribute
https://vuldb.com/submit/836328
Issue Tracking issue-tracking
https://github.com/TwiN/gatus/issues/1689

Scores

CVSS v3 3.7
EPSS 0.0028
EPSS Percentile 19.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-1004 CWE-614
Status published
Products (1)
TwiN/gatus 5.36.0
Published Jun 11, 2026
Tracked Since Jun 11, 2026