{"id":86971,"date":"2026-04-23T04:01:14","date_gmt":"2026-04-23T04:01:14","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T06:00:00","slug":"cve-2025-9086-cookie-security-override-leading-to-potential-system-compromise-or-data-leakage","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-9086-cookie-security-override-leading-to-potential-system-compromise-or-data-leakage\/","title":{"rendered":"CVE-2025-9086: Cookie Security Override Leading to Potential System Compromise or Data Leakage<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The vulnerability CVE-2025-9086 is a critical flaw that affects the proper functioning of secure cookies in web transactions. It allows an attacker to override the content of a secure cookie when interacting with an insecure host, leading to potential system compromise or data leakage. This contravenes the expected behavior, where the second set of the cookie should be ignored if it has already been established as secure on a secure host.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-9086
\nSeverity: High (CVSS: 7.5)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: Required
\nImpact: System compromise or data leakage<\/p>\n

Affected Products<\/strong><\/p>

\r\n

\r\n \r\n \"Ameeba\r\n <\/a>\r\n A new way to communicate\r\n <\/h2>\r\n\r\n

\r\n Ameeba Chat is built on encrypted identity, not personal profiles.\r\n <\/p>\r\n\r\n

\r\n Message, call, share files, and coordinate with identities kept separate.\r\n <\/p>\r\n\r\n