H3-2026-0069¶
Cookie Set Without Secure or HttpOnly Attributes
| Category | SECURITY_MISCONFIGURATION |
| Base Score | 1.0 |
Description¶
A web application issued a Set-Cookie response header that omitted one or more protective attributes: HttpOnly, or Secure (on HTTPS).
Impact¶
Cookies without HttpOnly are readable by client-side scripts, increasing the impact of cross-site scripting. Cookies without Secure can be transmitted over cleartext HTTP. This is a hardening gap rather than a directly exploitable weakness.