CVE-2026-54279: AIOHTTP Host-Only Cookie Persistence Vulnerability

Technical summary

The vulnerability exists in AIOHTTP's CookieJar serialization and deserialization logic. Host-only cookies—those with the host_only flag set to True—are designed to be accessible only by the exact host that set them, providing a defense against cross-domain cookie theft. When CookieJar.save() persists cookies to storage and CookieJar.load() restores them, the host-only attribute is not preserved. Upon restoration, affected cookies lose their host-only restriction and become accessible to related domains, violating the same-site cookie model. This is classified as an improper cookie restriction issue (CWE-665).

Business impact

Applications relying on AIOHTTP for session management, authentication, or sensitive state tracking face elevated risk. If cookies that should be strictly host-scoped are inadvertently shared across related domains after a save-restore cycle, attackers could hijack sessions or forge requests with privileges not intended for those domains. The practical impact depends on how an application uses cookies and whether session invalidation occurs between restarts. Organizations using AIOHTTP in production should assess whether their threat model includes attackers with network visibility or the ability to trigger cookie restoration events.

Affected systems

AIOHTTP versions prior to 3.14.1 are affected. This includes all 3.x releases up to 3.14.0. The framework is widely used in Python microservices, API clients, and web servers, particularly in asynchronous/asyncio-based architectures. Any Python application that uses AIOHTTP's CookieJar for HTTP session management and persists cookies across application restarts is potentially impacted.

Exploitability

The vulnerability requires no authentication or user interaction. An attacker positioned to observe or manipulate cookie storage on the target system—or who can trigger application restarts and subsequent cookie reloads—can exploit this. Practical attack scenarios include compromised container environments, supply-chain attacks on application images, or local privilege escalation on shared systems. The barrier to exploitation is moderate: the attacker needs file-system access to the cookie storage location or the ability to influence application behavior at restart.

Remediation

Upgrade AIOHTTP to version 3.14.1 or later. Verify the patched version is tested in your environment before production deployment. No workarounds exist for unpatched versions; host-only cookie semantics cannot be reliably enforced at the application level if the library itself does not preserve the flag.

Patch guidance

Apply the fix by updating AIOHTTP via your package manager (pip, conda, or your distribution's package management system) to 3.14.1 or later. Review your application's deployment pipeline to ensure patched versions are used in all environments—development, staging, and production. Test cookie persistence behavior after patching, particularly if your application relies on CookieJar save/load cycles. If you pin specific versions in requirements files, update those pinned versions and redeploy.

Detection guidance

Monitor for AIOHTTP versions older than 3.14.1 in your Python environment using dependency scanning tools (pip-audit, Snyk, Dependabot, or similar). Check application logs for evidence of cookie-based authentication issues or session anomalies that might indicate cookie scope bypass. In sensitive environments, audit your cookie storage implementation: verify that host-only flags are respected at the HTTP layer even if the AIOHTTP library loses them internally. Consider runtime checks of persisted cookie files to detect missing host-only attributes.

Why prioritize this

This vulnerability merits prompt attention due to its HIGH CVSS score (7.5) reflecting the availability impact and network accessibility of the flaw. While not yet in CISA's Known Exploited Vulnerabilities catalog, the simplicity of the root cause and its direct effect on cookie security make it a priority for any organization using AIOHTTP in production. The fix is straightforward (a version bump), reducing friction in prioritization.

Risk score, explained

CVSS 3.1 score of 7.5 (HIGH) reflects: AV:N (network-accessible; no special network conditions needed), AC:L (low attack complexity; no special conditions), PR:N (no privileges required), UI:N (no user interaction needed), S:U (impact confined to one security domain), C:N (no direct confidentiality loss), I:N (no direct integrity loss), A:H (high availability impact due to session/authentication disruption). The score emphasizes that exploitation is trivial once cookies are saved and restored, and the impact—loss of host-only protection—directly undermines access control.

Frequently asked questions