Boruta servers set session and remember‑me cookies without the Secure flag prior to version 0.9.1, exposing them to interception on insecure HTTP connections. An attacker who can observe this traffic can capture a valid authentication token and impersonate the original user, leading to unauthorized access and potentially full account compromise. The weakness corresponds to CWE‑614, which covers vulnerabilities that allow session hijacking or session fixation.

The affected components are part of the Malach‑IT Boruta Server suite, specifically boruta_web, boruta_identity, and boruta_admin. All releases before 0.9.1 are vulnerable, while version 0.9.1 and later include the fix that sets the Secure flag on relevant cookies.

The CVSS score of 8.8 indicates high severity. Although the EPSS score is not listed, the lack of a Secure cookie on a plaintext HTTP endpoint creates a clear attack path. An attacker with network visibility can intercept the cookie during an HTTP session, and because the session cookie is otherwise valid, it can be reused without further authentication steps. The vulnerability is not listed in CISA’s KEV catalog, but the high CVSS score and user‑session takeover potential warrant urgent attention.