Versions of the PHP HTTP client library before 7.15.1 fail to preserve host-only cookie scope. Instead of treating cookies as host-only, the library stores the request host in the Domain field, which allows any subsequently accessed child host to read those cookies. The exposed cookies may contain session identifiers or authorization tokens that should have been limited to the original parent host, thereby risking session hijacking and credential disclosure.

The affected component is the Guzzle PHP HTTP client library. All deployments using guzzlehttp/guzzle versions older than 7.15.1 are vulnerable, regardless of the application or framework that incorporates the library.

The CVSS score of 8.2 indicates a high severity vulnerability. The EPSS score is not available, so no exploitation likelihood estimate is provided. This issue is not listed in the CISA KEV catalog. Attackers would need control over or influence of a child host that a vulnerable application contacts, or the ability to execute code that injects requests via the library, to exploit the weakness. Once the attacker can make the application request a child host, they can capture the host-only cookies and use them for unauthorized access.