CVE-2025-53861: Aap: sensitive cookie(s) set without security flags
A flaw was found in Ansible. Sensitive cookies without security flags over non-encrypted channels can lead to Man-in-the-Middle (MitM) and Cross-site scripting (XSS) attacks allowing attackers to read transmitted data.
Other sources
A flaw was found in Ansible. Sensitive Cookies without Security Flags over non-encrypted channels may lead to Man-in-the-Middle (MitM) and Cross-site Scripting (XSS).
Flags such as "Set-Cookie: EXAMPLE=AAAABBBBCCCCDDDDAAAABBBCCC; path=/; HttpOnly; Secure; SameSite=[Strict or Lax];" are required to mitigate this issue.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-53861?
CVE-2025-53861 has been classified with a significant severity due to the potential for Man-in-the-Middle and Cross-site scripting attacks.
What vulnerabilities are introduced by CVE-2025-53861?
CVE-2025-53861 introduces vulnerabilities related to the transmission of sensitive cookies over non-encrypted channels.
How do I fix CVE-2025-53861?
To fix CVE-2025-53861, ensure that sensitive cookies are set with appropriate security flags and transmitted over encrypted connections.
Who is affected by CVE-2025-53861?
CVE-2025-53861 affects all users of Ansible that utilize sensitive cookies without security flags.
What kind of attacks can CVE-2025-53861 lead to?
CVE-2025-53861 can lead to Man-in-the-Middle (MitM) attacks and Cross-site scripting (XSS) attacks, compromising sensitive data.