CPython http.cookiejar can delete other domains' cookies
Python rates CVE-2026-124249 medium: an expired Set-Cookie can remove cookies that belong to other domains.
Stories per day · 30 days
2 RSS
4 stories, newest first · one card per story
Stories tagged #cookies
CVE-2026-82355: Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation
Apache Airflow lets a session cookie override a bearer token, enabling session fixation.
ChatGPT now knows what you do on other websites via ad collector
Researcher demonstrates OpenAI's __obi cookie links ChatGPT accounts to browsing on advertiser sites via SameSite=None tracking and pixel SDK data collection.
1
datasette-auth-github 1.0
Simon Willison released datasette-auth-github 1.0, fixing session cookies that lacked Max-Age and expired early, especially in Mobile Safari.