CakePHP versions up to 5.4.3 contain an Http Client CookieCollection that validates cookie domains using unanchored suffix matching. Attackers who control a host sharing a domain suffix with the victim or who can inject Set‑Cookie headers with a crafted Domain attribute can read or inject cookies into the shared client cookie jar. This flaw can expose session tokens and allow tampering with authentication data, compromising both confidentiality and integrity.

All installations of CakePHP 5.4.3 or earlier that use the Http Client CookieCollection are affected. The vulnerable component is maintained by the cakephp:cakephp project; no specific third‑party editions are listed.

The vulnerability carries a CVSS score of 6.3, indicating medium severity. EPSS data is not available and the flaw is not cataloged in CISA's KEV, suggesting limited current exploitation. Nonetheless, the attack requires control of a domain that matches a victim suffix or the ability to deliver malicious Set‑Cookie headers, which can be achieved via compromised DNS or proxy services. Because the attack path is remote and does not require privileged local access, a cautious risk assessment recommends prompt remediation.