The vulnerability is a logic flaw in http4s’ CookieJar client middleware. Instead of applying RFC 6265 domain and path matching, the middleware uses unanchored substring checks to determine whether a stored cookie should be attached to an outbound request. Consequently, a cookie that belongs to "example.com" can be sent to an attacker‑controlled host such as "evilexample.com" when an application using the same cookie jar performs an attacker‑influenced request. This exposes session or authentication cookies and can allow an attacker to hijack the application’s outbound sessions, compromising confidentiality and integrity. The flaw is associated with CWE‑1275 and CWE‑565.

Any Scala application that uses the http4s library with the CookieJar middleware prior to version 0.23.35 or 1.0.0‑M47 is affected. The issue is fixed in http4s v0.23.35 and v1.0.0‑M47 and later releases.

The CVSS score of 6.8 indicates a moderate severity, and the EPSS score is <1%, indicating a low exploitation probability, but the lack of KEV listing does not eliminate risk. The most likely attack vector is an attacker who can influence the application’s outbound requests, such as by injecting URLs or crafting requests that the application forwards. The flaw allows the attacker to read or tamper with cookies that should be restricted to the original domain, enabling session hijacking or other credential‑based attacks.