This vulnerability permits a subdomain to remove the host‑only restriction from a cookie that was originally scoped to a parent domain. When the host‑only attribute is dropped, a cookie that should have been sent only to the parent domain becomes eligible for transmission to other subdomains. The effect is a loss of isolation for cookies that may carry sensitive data. This can enable an attacker to capture or tamper with credentials or session identifiers that the application subsequently forwards to a browser, potentially enabling credential theft or session hijacking. The weakness corresponds to CWE-565, improper handling of security attributes.

The flaw affects any installation of the aio-libs:aiohttp asynchronous HTTP framework running a version earlier than 3.14.4. All applications that rely on aiohttp for HTTP handling, whether in client or server mode, are at risk until they upgrade to the patched release.

The CVSS score of 2.3 indicates a low severity impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote user accessing a malicious or untrusted subdomain that triggers the cookie modification. Exploitation requires that the application propagate the altered cookie to a browser; if the application does not send cookies to the client, the threat is further mitigated.