AIOHTTP had a flaw where the Secure attribute for a shared cookie was not enforced. This allowed the cookie to be sent over an unencrypted request, which means anyone able to capture that traffic could read the cookie value. The vulnerability effectively enables cookie theft or session hijacking and is linked to the CWE‑1004 and CWE‑311 weaknesses in the library.

The issue affects the aio‑libs:aiohttp library. Versions older than 3.14.4 are impacted. Any application that uses aiohttp to handle shared cookies over non‑TLS connections is vulnerable.

The CVSS score of 6.3 indicates moderate severity, and the EPSS score is not available so current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. An attacker who can intercept HTTP traffic might exploit the flaw by capturing a secure cookie that should only be transmitted over TLS, potentially leading to credential compromise and unauthorized session use.