CWE-1004Sensitive Cookie Without 'HttpOnly' Flag

Abstraction: Variant · CVEs in our corpus: 40

The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

The HttpOnly flag directs compatible browsers to prevent client-side script from accessing cookies. Including the HttpOnly flag in the Set-Cookie HTTP response header helps mitigate the risk associated with Cross-Site Scripting (XSS) where an attacker's script code might attempt to read the contents of a cookie and exfiltrate information obtained. When set, browsers that support the flag will not reveal the contents of the cookie to a third party via client-side script executed via XSS.

Last updated: 09 May 2026 03:25 UTC

NIST 800-53 r5 controls that address this weakness (0)AI

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2025-26844`	2.0	9.8	0.0037	2025-05-08
`CVE-2025-27223`	1.8	7.5	0.0551	2025-10-27
`CVE-2021-42115`	1.7	8.1	0.0057	2021-11-30
`CVE-2026-25136`	1.6	8.1	0.0008	2026-02-25
`CVE-2026-35575`	1.6	8.0	0.0004	2026-04-07
`CVE-2026-42239`	1.6	8.1	0.0003	2026-05-07
`CVE-2021-3706`	1.5	7.5	0.0015	2021-09-15
`CVE-2022-21939`	1.5	7.5	0.0022	2023-02-09
`CVE-2024-41685`	1.5	7.5	0.0023	2024-07-26
`CVE-2025-57424`	1.5	7.3	0.0003	2025-09-29
`CVE-2026-25733`	1.5	7.3	0.0006	2026-02-25
`CVE-2020-27658`	1.4	7.1	0.0026	2020-10-29
`CVE-2025-24318`	1.4	6.8	0.0011	2025-02-28
`CVE-2019-8283`	1.3	6.5	0.0030	2019-06-07
`CVE-2021-39210`	1.3	6.5	0.0027	2021-09-15
`CVE-2024-47833`	1.3	6.5	0.0008	2024-10-09
`CVE-2025-47289`	1.3	6.3	0.0013	2025-06-02
`CVE-2026-0696`	1.3	6.5	0.0002	2026-01-16
`CVE-2022-25172`	1.2	6.1	0.0031	2022-05-12
`CVE-2026-25734`	1.2	6.1	0.0009	2026-02-25
`CVE-2026-25735`	1.2	6.1	0.0009	2026-02-25
`CVE-2026-25736`	1.2	6.1	0.0009	2026-02-25
`CVE-2026-39338`	1.2	6.1	0.0004	2026-04-07
`CVE-2020-6267`	1.1	5.4	0.0017	2020-07-14
`CVE-2022-4630`	1.1	5.3	0.0019	2022-12-21