Lavish

The issue is related to the incorrect handling of cookies by PHP applications, allowing network and same-site attackers to set a standard insecure cookie in the victim's browser, which is then treated as a Host- or Secure- cookie. This can potentially lead to session hijacking and unauthorized access to protected information.

The issue is related to how Werkzeug handles "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `= Host-test=bad` for another subdomain. Werkzeug will parse the cookie `= Host-test=bad` as ` Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key.

The issue arises when ReactPHP's HTTP server component processes incoming HTTP cookie values, url-decoding the cookie names. This can lead to confusion between cookies with prefixes like ` Host-` and ` Secure-` and those that decode to such prefixes, allowing an attacker to forge secure cookies.