TwiN gatus OIDC Session Cookie oidc.go setSessionCookie missing secure attribute

published 2026-06-11 4 mo ago modified 2026-10-26 14 d ago also EUVD-2026-36236

cvss: 3.7; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits: 0; none known

A vulnerability was determined in TwiN gatus 5.36.0. Impacted is the function setSessionCookie of the file security/oidc.go of the component OIDC Session Cookie Handler. Executing a manipulation can lead to sensitive cookie without secure attribute. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The reported GitHub issue was closed with the label "not planned".

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 4 mo ago (2026-06-11)

Exploit prediction

0.19% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

vuldb.com https://vuldb.com/submit/836328 referenced PoC, tagged "exploit" by a source, unverified
github.com https://github.com/TwiN/gatus/issues/1689 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	6.3	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
CNA	3.1	3.7	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R
CNA	3.0	3.7	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R
CNA	2.0	2.6	AV:N/AC:H/Au:N/C:P/I:N/A:N/E:ND/RL:ND/RC:UR
CNA	4.0	6.3	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	3.7	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA	2.0	2.6	AV:N/AC:H/Au:N/C:P/I:N/A:N

Affected products

TwiN gatus

Classification

Weakness

CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag

References

vuldb.com /submit/836328
third-party-advisory, exploit
github.com /TwiN/gatus/issues/1689
issue-tracking, exploit
vuldb.com /vuln/370343
vdb-entry, technical-description
vuldb.com /vuln/370343/cti
signature, permissions-required
vuldb.com /cve/CVE-2026-11956
third-party-advisory
github.com /TwiN/gatus/
product

Sources

CVE List CVE-2026-11956
NVD CVE-2026-11956

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary