The vulnerability allows an attacker to hijack user sessions by exploiting an insecure cookie configuration. Because the cookie set by JetBrains Datalore lacks the Secure flag, it can be transmitted over non‑HTTPS connections and may be captured or forged. An attacker who obtains a valid session cookie can impersonate a user and gain unauthorized access to the Datalore workspace, exposing sensitive data and potentially enabling further attacks. The weakness is represented by CWE‑319 and CWE‑614.

JetBrains Datalore products before release 2026.1 are affected. All installations that use the default unsecured cookie setting are at risk; no specific sub‑version details are provided beyond the pre‑2026.1 timeframe.

The CVSS score of 6.3 indicates moderate severity. The EPSS score is less than 1%, suggesting a low likelihood of exploitation in the short term, though the impact remains serious if the flaw is used. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only the ability to read or modify cookie values, which can be achieved by intercepting traffic over HTTP or via cross‑site scripting. Thus the primary attack vector is inferred to be remote over unsecured connections, potentially in environments where the Datalore server is reachable via HTTP.