AIKIDO-2026-74412

guzzlehttp/guzzle is vulnerable to Origin Validation Error

Origin Validation ErrorGHSA-f7vp-7xgx-4w4r Published Jul 28, 2026

Medium Risk

This Affects:

guzzlehttp/guzzle

0.0.1 - 7.15.1

Fixed in 7.15.2

8.0.0 - 8.0.0

Fixed in 8.0.1

Are you affected? Scan for Free

TL;DR

Guzzle's SetCookie::matchesDomain() grants every subdomain of a cookie Domain that cookie unless it recognizes the domain as an IP or numeric host, and it makes that decision from the domain text rather than the canonical address a transport uses. Noncanonical spellings such as hexadecimal, mixed-base, or percent-escaped domains therefore keep subdomain scope while the transport reads them as an address like 127.0.0.1. Before the fix a shared cookie jar sends a cookie scoped to such a spelling to any look-alike host ending in it, disclosing session identifiers, and it accepts and replays externally set cookies, enabling session fixation. The fix holds percent-escaped and numeric-in-any-base cookie domains to an exact match against the request host.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application uses Guzzle's cookie support with a cookie jar shared across hosts that can hold a cookie scoped to a numeric or percent-escaped domain spelling.