CWE · MITRE source
CWE-1275Sensitive Cookie with Improper SameSite Attribute
The SameSite attribute for sensitive cookies is not set, or an insecure value is used.
The SameSite attribute controls how cookies are sent for cross-domain requests. This attribute may have three values: 'Lax', 'Strict', or 'None'. If the 'None' value is used, a website may create a cross-domain POST HTTP request to another website, and the browser automatically adds cookies to this request. This may lead to Cross-Site-Request-Forgery (CSRF) attacks if there are no additional protections in place (such as Anti-CSRF tokens).
Last updated: 09 May 2026 03:25 UTC
NIST 800-53 r5 controls that address this weakness (0)AI
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
| No NIST controls proposed yet. | |||
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2024-6611 | 2.0 | 9.8 | 0.0059 | 2024-07-09 |
CVE-2023-53957 | 2.0 | 9.8 | 0.0024 | 2025-12-19 |
CVE-2025-24897 | 1.6 | 8.2 | 0.0004 | 2025-02-11 |
CVE-2026-1697 | 1.3 | 6.5 | 0.0002 | 2026-02-26 |
CVE-2022-38386 | 1.2 | 5.9 | 0.0007 | 2024-05-01 |
CVE-2024-30155 | 1.1 | 5.5 | 0.0014 | 2025-03-26 |
CVE-2024-42212 | 1.1 | 5.4 | 0.0017 | 2025-05-05 |
CVE-2025-24387 | 1.0 | 4.8 | 0.0008 | 2025-03-10 |
CVE-2025-52628 | 0.9 | 4.6 | 0.0005 | 2026-02-03 |
CVE-2024-43173 | 0.7 | 3.7 | 0.0009 | 2024-10-22 |
CVE-2025-36134 | 0.7 | 3.7 | 0.0003 | 2025-11-25 |