CVE-2026-11956: TwiN gatus OIDC Session Cookie Security Flaw – Analysis & Remediation

Technical summary

CVE-2026-11956 affects the setSessionCookie function in security/oidc.go within TwiN gatus 5.36.0. The vulnerability stems from improper cookie configuration during OIDC-based authentication, where the secure flag—which restricts cookie transmission to HTTPS only—is not properly set. This creates a pathway for sensitive session data to be sent over cleartext channels. The flaw requires high attack complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) and manifests primarily as a confidentiality issue, with a CVSS v3.1 base score of 3.7 (LOW).

Business impact

The primary business risk centers on session hijacking if cookies are intercepted over unencrypted connections. In environments where users access gatus over HTTP (e.g., internal networks without TLS enforcement or misconfigured reverse proxies), attackers on the network path could capture authentication cookies and impersonate users. This undermines the security guarantees that OIDC authentication is meant to provide. For organizations relying on gatus for status monitoring or system access control, unauthorized session access could grant visibility into infrastructure health data or, depending on gatus's deployment scope, control plane access.

Affected systems

TwiN gatus version 5.36.0 is confirmed affected. The vulnerability resides in the OIDC session cookie handler, so it is only triggered when OIDC authentication is enabled. Organizations using gatus without OIDC, or with OIDC disabled, are not impacted. The issue does not affect availability or integrity; only confidentiality of session tokens is at risk.

Exploitability

Exploitation requires high technical complexity and is considered difficult according to the CVE record. An attacker must be positioned to intercept network traffic (e.g., on the same network segment or through BGP hijacking/DNS spoofing for remote exploitation) and must manipulate the application into generating a cookie without the secure flag. No active public exploits are known, and the GitHub issue was closed with a "not planned" label, suggesting the maintainers may not view this as exploitable under their threat model or may have architectural reasons for the current behavior. However, security-conscious deployments should still address the root cause.

Remediation

The definitive solution is to upgrade TwiN gatus beyond version 5.36.0. Verify the availability of a patched version from the official TwiN gatus repository. As an interim measure, enforce HTTPS-only access to gatus at the reverse proxy or network level, ensuring that even if cookies lack the secure flag, they cannot be transmitted over HTTP. Additionally, review OIDC configuration settings to confirm that session cookies are handled securely in your deployment.

Patch guidance

Check the TwiN gatus GitHub repository or official release notes for version numbers that address CVE-2026-11956. Apply the patch as part of routine security updates. Since the attack requires high complexity to execute, this is a lower-priority patch compared to critical vulnerabilities, but should still be scheduled within standard patch windows (30–60 days). Test the patched version in a staging environment to confirm OIDC session handling and any other authentication flows continue to function as expected.

Detection guidance

Monitor HTTP access logs for OIDC-related endpoints (typically /oidc/callback or similar) and flag any non-HTTPS requests that succeed. Use network-level detection to identify unencrypted cookie transmission over HTTP. In HTTP response headers, verify that Set-Cookie directives include the Secure attribute for all session cookies. Application-level logging or instrumentation of the setSessionCookie function can confirm whether the secure flag is being set correctly. Organizations using Web Application Firewalls (WAF) may implement rules to detect or block HTTP-transmitted session cookies.

Why prioritize this

This vulnerability scores LOW (3.7) due to the high attack complexity required and limited impact scope (confidentiality only). However, prioritization should account for whether OIDC is enabled in your gatus deployment and whether HTTP access to gatus is possible or enforced by policy. Organizations with strict network segmentation or HTTPS-everywhere policies face minimal risk. Conversely, environments with internet-facing or loosely segregated gatus instances should elevate priority. The maintainers' "not planned" closure suggests this may be intended behavior or a design decision; clarify intent with the TwiN team before investing substantial remediation effort.

Risk score, explained

The CVSS v3.1 score of 3.7 reflects: Network-accessible attack surface (AV:N), high complexity required to exploit (AC:H), no authentication or user interaction needed (PR:N/UI:N), unchanged scope (S:U), and only low-impact confidentiality loss (C:L/I:N/A:N). The score accurately represents a scenario in which an attacker must be well-positioned and the exposure is narrowly scoped to session token confidentiality. It does not account for downstream consequences (e.g., lateral movement after session hijacking), which would be context-dependent.

Frequently asked questions