AIOHTTP’s Secure attribute was not enforced for shared cookies before version 3.14.4, allowing a cookie marked as Secure to be transmitted over unencrypted HTTP. This flaw enabled an attacker to intercept token or session data that should only travel over TLS, leading to possible credential theft or unauthorized session use.

Applications that depend on the aio-libs:aiohttp library and use its shared cookie feature are affected. All releases prior to 3.14.4 are vulnerable; updating to the 3.14.4 release or later resolves the issue.

With a CVSS score of 6.3, the vulnerability carries moderate severity. No EPSS value is available, so the current exploitation likelihood is uncertain. The issue is not listed in the CISA KEV catalog. An attacker who can observe or inject traffic on an application's non‑TLS endpoints could capture the insecurely transmitted cookie, potentially compromising user sessions.