The flaw occurs in TwiN gatus’s OIDC Session Cookie Handler, where the setSessionCookie routine does not set the Secure flag on session cookies. A cookie lacking this attribute can be transmitted over unencrypted channels, allowing an attacker with network visibility to intercept it and hijack a user’s authenticated session. The vulnerability is categorized as CWE‑1004 and CWE‑614 and can compromise confidentiality and integrity of sensitive data if an attacker steals session state.

All installations of TwiN gatus version 5.36.0 are affected. The issue is present in the security/oidc.go component of that release. Future releases that include the secure flag fix are not impacted.

The CVSS score of 6.3 indicates a medium severity risk. The exploit is remote and requires high complexity and is considered difficult to execute. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited current exploitation activity. Nonetheless, exposure of session cookies over insecure links remains a significant threat to authenticated sessions.