CWE-1004Sensitive Cookie Without 'HttpOnly' Flag

Abstraction: Variant · CVEs in our corpus: 42

The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

Last updated: 20 August 2026 13:14 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 2 mapping(s) from 1 framework(s): CSF 2.0 2 (mostly)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A02:2025 Security Misconfiguration.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.AT-02
PR.PS-06
SC-23 Session Authenticity

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2025-26844`	7.3	9.8	0.0041	2025-05-08
`CVE-2021-42115`	6.4	8.1	0.0124	2021-11-30
`CVE-2025-27223`	6.2	7.5	0.0207	2025-10-27
`CVE-2021-3706`	6.1	7.5	0.0110	2021-09-15
`CVE-2026-25136`	6.0	8.1	0.0026	2026-02-25
`CVE-2024-41685`	5.9	7.5	0.0050	2024-07-26
`CVE-2026-35575`	5.9	8.0	0.0024	2026-04-07
`CVE-2022-21939`	5.7	7.5	0.0055	2023-02-09
`CVE-2026-42239`	5.7	8.1	0.0028	2026-05-07
`CVE-2020-27658`	5.5	7.1	0.0131	2020-10-29
`CVE-2025-57424`	5.5	7.3	0.0025	2025-09-29
`CVE-2026-25733`	5.5	7.3	0.0026	2026-02-25
`CVE-2019-8283`	5.3	6.5	0.0119	2019-06-07
`CVE-2021-39210`	5.3	6.5	0.0101	2021-09-15
`CVE-2024-47833`	5.0	6.5	0.0025	2024-10-09
`CVE-2025-24318`	5.0	6.8	0.0034	2025-02-28
`CVE-2026-0696`	5.0	6.5	0.0036	2026-01-16
`CVE-2026-57948`	5.0	6.8	0.0013	2026-06-29
`CVE-2022-25172`	4.8	6.1	0.0102	2022-05-12
`CVE-2025-47289`	4.8	6.3	0.0022	2025-06-02
`CVE-2026-25734`	4.7	6.1	0.0029	2026-02-25
`CVE-2026-25735`	4.7	6.1	0.0029	2026-02-25
`CVE-2026-25736`	4.7	6.1	0.0029	2026-02-25
`CVE-2020-6267`	4.5	5.4	0.0078	2020-07-14
`CVE-2022-4630`	4.5	5.3	0.0063	2022-12-21