Niedrig 3.1Linux-Server
CVE-2026-126067
actionpack: Action Pack: Cross-Site Request Forgery via missing SameSite attribute on session cookies
actionpack
### Impact Action Pack session stores other than `ActionDispatch::Session::CookieStore` (`CacheStore`, `MemCacheStore`, and third-party stores built on `AbstractStore`, `AbstractSecureStore` or the session mixins) write the session cookie without a `SameSite` attribute, regardless of `config.action_dispatch.cookies_same_site_protection`, which defaults to `:lax`. Only `CookieStore` applies the configured policy. In browsers that do not treat a cookie without the attribute as…
10. Nov 2026
Original bei Red Hat öffnen