CWE · MITRE source
CWE-1275Sensitive Cookie with Improper SameSite Attribute
The SameSite attribute for sensitive cookies is not set, or an insecure value is used.
The SameSite attribute controls how cookies are sent for cross-domain requests. This attribute may have three values: 'Lax', 'Strict', or 'None'. If the 'None' value is used, a website may create a cross-domain POST HTTP request to another website, and the browser automatically adds cookies to this request. This may lead to Cross-Site-Request-Forgery (CSRF) attacks if there are no additional protections in place (such as Anti-CSRF tokens).
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: full · 3 mapping(s) from 3 framework(s): ASVS 5.0 1 (full) · OWASP-Web 1 (mostly) · CAPEC 1 (partial)
OWASP Top 10 for Web (2025)
This weakness contributes to A01:2025 Broken Access Control.
NIST 800-53 r5 controls that address this weakness (0)AI
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
| No NIST controls proposed yet. | |||
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2024-6611 | 7.0 | 9.8 | 0.0066 | 2024-07-09 |
CVE-2023-53957 | 7.0 | 9.8 | 0.0050 | 2025-12-19 |
CVE-2025-24897 | 5.5 | 8.2 | 0.0013 | 2025-02-11 |
CVE-2026-8409 UPD | 5.5 | 8.8 | 0.0014 | 2026-05-21 |
CVE-2026-8410 UPD | 5.5 | 8.8 | 0.0014 | 2026-05-21 |
CVE-2026-8411 UPD | 5.5 | 8.8 | 0.0013 | 2026-05-21 |
CVE-2026-8412 UPD | 5.5 | 8.8 | 0.0013 | 2026-05-21 |
CVE-2026-8413 UPD | 5.5 | 8.8 | 0.0013 | 2026-05-21 |
CVE-2026-8414 UPD | 5.5 | 8.8 | 0.0013 | 2026-05-21 |
CVE-2026-8415 UPD | 5.5 | 8.8 | 0.0013 | 2026-05-21 |
CVE-2026-8416 UPD | 5.5 | 8.8 | 0.0013 | 2026-05-21 |
CVE-2026-8427 UPD | 5.5 | 8.8 | 0.0013 | 2026-05-21 |
CVE-2026-8432 UPD | 5.5 | 8.8 | 0.0013 | 2026-05-21 |
CVE-2026-8433 UPD | 5.5 | 8.8 | 0.0013 | 2026-05-21 |
CVE-2026-8434 UPD | 5.5 | 8.8 | 0.0013 | 2026-05-21 |
CVE-2022-38386 | 3.5 | 5.9 | 0.0046 | 2024-05-01 |
CVE-2025-24387 | 3.5 | 4.8 | 0.0014 | 2025-03-10 |
CVE-2024-30155 | 3.5 | 5.5 | 0.0021 | 2025-03-26 |
CVE-2024-42212 UPD | 3.5 | 5.4 | 0.0020 | 2025-05-05 |
CVE-2025-52628 | 3.5 | 4.6 | 0.0019 | 2026-02-03 |
CVE-2026-1697 | 3.5 | 6.5 | 0.0012 | 2026-02-26 |
CVE-2026-8435 UPD | 3.5 | 6.5 | 0.0011 | 2026-05-21 |
CVE-2026-55688 | 3.5 | 4.0 | 0.0018 | 2026-07-01 |
CVE-2024-43173 | 1.5 | 3.7 | 0.0021 | 2024-10-22 |
CVE-2025-36134 | 1.5 | 3.7 | 0.0026 | 2025-11-25 |