The vulnerability lies in the WebClientSession component of Eclipse Vert.x Web Client, which fails to enforce the Domain attribute of a Set‑Cookie header against the originating server’s domain, a deviation from RFC 6265 section 5.3. The flaw, identified as CWE‑346, permits a malicious server to inject a cookie scoped to an arbitrary third‑party domain. Because the session store performs no cross‑domain ownership check, it stores the malicious cookie and later forwards it when the victim application sends a request to the targeted domain, causing the remote service to authenticate the request under the attacker’s account. This results in unauthorized access to sensitive data such as payment amounts or API payloads that were originally intended for the victim’s legitimate account.

Eclipse Vert.x Web Client, part of the Eclipse Foundation Eclipse Vert.x platform. All releases up to and including 4.5.29 on the 4.x branch and 5.1.4 on the 5.x branch are affected.

The CVSS score of 8.2 indicates severe risk, while the EPSS score of less than 1% suggests a low but non‑zero probability of exploitation. The vulnerability is not yet listed in CISA’s KEV catalog. An attacker who controls any server the victim application contacts can remotely inject a malicious Set‑Cookie header; the session store then forwards that cookie to the intended third‑party domain, allowing the attacker to impersonate legitimate user accounts and potentially disclose confidential or sensitive information.