In Tornado prior to version 6.5.5 the method RequestHandler.set_cookie failed to validate the domain, path and samesite arguments, enabling an attacker to craft cookie attributes that alter cookie behavior. By injecting special characters an adversary could set cookies with unintended scopes or attribute values, potentially bypassing same‑site restrictions or establishing cross‑domain cookies. This weakness is classified under CWE‑159 (Improper Validation of Input) and CWE‑88 (Improper Specification of Cookie Use). The resulting impact is the ability to manipulate the session context, leading to session hijacking or privilege escalation within the application.

The vulnerability affects the Tornado web framework provided by Tornadoweb. Any deployment of Tornado that is running a version earlier than 6.5.5 is susceptible. Systems that rely on RequestHandler.set_cookie to configure user sessions or cross‑site tokens are at risk.

The CVSS score of 7.2 indicates a high severity vulnerability. The EPSS score of less than 1 percent suggests that exploitation of this weakness is unlikely to be widespread at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The most likely attack vector is a remote attacker exploiting a web application that incorrectly supplies cookie arguments to set_cookie; the attacker would need to craft a response that triggers the injection path in the target server.