Eclipse Vert.x Web Client Cookie Domain Validation Bypass

In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does not validate that the Domain attribute of a Set-Cookie response header matches the originating server's domain, in violation of RFC 6265 section 5.3. An attacker who controls any server that the victim application contacts can inject a cookie scoped to an arbitrary third-party domain; because the session store performs no cross-domain ownership check, it stores and later transmits that cookie to the targeted domain. When the victim application subsequently sends a request to the targeted domain using the same WebClientSession, it presents the attacker-injected cookie, causing the receiving service to process the request under the attacker's account. Sensitive data included in the victim application's requests, such as payment amounts, card details, or other API payloads, may then be accessible to the attacker through their own account on that

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Eclipse Vert.x Web Client versions 4.5.29 and earlier (4.x branch) and 5.1.4 and earlier (5.x branch) contain a critical cookie handling flaw where the Domain attribute of Set-Cookie response headers is not validated against the originating server's domain, violating RFC 6265 standards. This allows attackers controlling any server contacted by a vulnerable application to inject cookies scoped to arbitrary third-party domains. Applications using affected versions become vectors for session hijacking, cross-site request forgery (CSRF), and credential theft, as malicious cookies persist in the session store without proper domain ownership verification. Organizations running Eclipse Vert.x Web Client in microservices architectures, API gateways, or multi-domain applications face significant exposure to privilege escalation and data exfiltration attacks.

Casky's 322 matching security skills leverage Claude's extended reasoning to detect attack patterns associated with techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance via MITRE ATT&CK mapping). Practitioners using Casky will observe findings that correlate suspicious cookie injection attempts with anomalous domain scoping—detecting when Set-Cookie headers originate from unexpected servers or when session tokens appear bound to domains outside normal application topology. The platform identifies the vulnerability's CWE-346 (Origin Validation Error) signature by flagging cases where domain checks are missing from cookie handling logic, allowing practitioners to spot exploitation attempts before session compromise occurs. Integration with threat detection workflows enables teams to correlate these indicators with outbound connections to untrusted servers, revealing the reconnaissance and initial access chains attackers use to weaponize this flaw.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-15076.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-15076

Casky has 322 skills that investigate the attack patterns behind CVE-2026-15076. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn