Vulnerability record · CVE-2022-31629 · published 28 September 2022
CVE-2022-31629: PHP cookie prefix validation flaw allows insecure cookie spoofing
Php · Php
PHP before 7.4.31, 8.0.24 and 8.1.11 fails to properly validate cookie names, letting network and same-site attackers set an ordinary insecure cookie that PHP applications then treat as a `__Host-` or `__Secure-` cookie. This undermines the browser-enforced guarantees those prefixes are meant to provide, so applications relying on them for session or security decisions can be misled.
Description
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Automated analysis
medium priorityCVSS 6.5 Medium with high EPSS and public exploit detail, but exploitation needs user interaction and impact is limited to cookie integrity.
What it is
PHP before 7.4.31, 8.0.24 and 8.1.11 fails to properly validate cookie names, letting network and same-site attackers set an ordinary insecure cookie that PHP applications then treat as a `__Host-` or `__Secure-` cookie. This undermines the browser-enforced guarantees those prefixes are meant to provide, so applications relying on them for session or security decisions can be misled.
Impact
An attacker can plant a cookie that the application accepts as a protected `__Host-`/`__Secure-` cookie, enabling session fixation or cookie-based logic bypass. Integrity impact is rated High; confidentiality and availability impacts are None.
Attack surface
Reachable over the network with no authentication (AV:N/PR:N), but exploitation requires user interaction (UI:R) because the victim's browser must be induced to accept the attacker-set cookie. The description notes both network and same-site attackers.
Exploitation
Not listed in CISA KEV, but EPSS is high (0.49336, 98.8th percentile) and the PHP bug report is tagged Exploit, indicating public exploit detail exists. No ransomware usage is documented.
What to do
- Upgrade PHP to 7.4.31, 8.0.24, 8.1.11 or later; apply the corresponding Debian, Fedora and Gentoo package updates.
- Do not rely solely on `__Host-`/`__Secure-` cookie prefixes for security decisions; enforce server-side session validation.
- Regenerate session identifiers on authentication and reject cookies whose names or attributes do not match expected values.
- Audit application code for trust in cookie prefix semantics and add explicit checks on cookie origin and attributes.
Detection
- Monitor web logs for requests carrying `__Host-` or `__Secure-` cookie names that do not match legitimate application-set values.
- Alert on session identifier changes or fixation patterns around authentication events.
- Review application logs for cookie-based authorization decisions made without server-side session checks.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2022-31629 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-31629), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
