JetBrains Ktor implementations prior to 3.6.1 allow an attacker to inject arbitrary cookies because the client cookie storage does not validate the Domain attribute. This flaw permits the creation or modification of cookies that can be used to impersonate legitimate sessions or tamper with client state, exposing both confidentiality and integrity of user data.

The vulnerability is present in JetBrains Ktor libraries older than version 3.6.1. Systems using any earlier release of Ktor are affected and must verify their installed component version.

The CVSS score of 3.7 indicates low overall severity, and the EPSS score is not available. The flaw is not listed in CISA KEV. Attackers would need the ability to influence the application’s cookie handling, which is generally limited to the local or compromised environment of the affected application. While exploitation is unlikely to be widespread, it remains feasible for a malicious application built on Ktor to inject abusive cookies and hijack sessions.