vulns.co
/
GKData.io MCP

Back to Gadgets

Cookie scoped to the parent domain

A session cookie whose Domain attribute is the parent site is sent to every subdomain, not only the host that set it, and omitting Domain keeps the cookie on the exact host. Setting the attribute to the parent is the gadget. A host-only prefix such as…

Tags: cookie, session, domain, sso

Typical severity: P3-P5

What it becomes

Low alone, and it becomes account takeover when any sibling host can receive that cookie or write a shadowing one.

Where to look

  • Set-Cookie on the apex and on the app host
  • SSO cookies shared with sibling sites
  • docs, status, and marketing hosts under the same parent

Chains

  • Sibling takeover: A subdomain you can script or reclaim receives the parent-scoped session cookie, or the browser sends it there.
  • Cookie shadowing: A sibling is allowed to set the same parent-scoped name, and the app prefers the value the sibling wrote.

Notes

  • HttpOnly stops script from reading the cookie. It does not stop the browser from sending it, and it does not stop a sibling from setting a shadowing cookie.
  • Do not take over a sibling unless the program allows that host. Pair the cookie scope with a sibling you already control, or stop at the scope evidence.