Unauthenticated go-httpbin servers : Leads to Cookie Tossing on *.aws.dev and Open Redirect

How it was found

Description: The unauthenticated go-httpbin instance exposes multiple endpoints that accept attacker-controlled input without appropriate validation.

Two issues were identified:

1. Cross-subdomain cookie tossing / cookie injection - /cookies/set allows an unauthenticated user to specify an arbitrary cookie Domain, including the parent aws.dev domain. This allows attacker-controlled cookies set from one *.aws.dev host to be delivered to unrelated sibling applications.
2. Open redirect - /redirect-to accepts an arbitrary URL and redirects the victim to that destination without validation.

The cookie issue was verified against unrelated *.aws.dev applications. A crafted cookie value was also observed to cause a separate application at ████████ to receive a CloudFront/WAF 403 response, demonstrating a practical cross-tenant denial-of-service impact.

Endpoints:

████████
████████
████████

As an example, Impact was tested on ████████

Steps To Reproduce:

Open Redirect :

Observe the open redirect to arbitrary domains :

$ curl -s ████████redirect-to?url=http://google.com -D - -o /dev/null
HTTP/1.1 302 Found
Server: ████████
Date: Mon, 24 Aug 2026 21:27:43 GMT
Content-Length: 0
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Location: http://google.com

$

For Cookie Tossing / Cookie Injection :

1. (Not related to vulnerable endpoint) First navigate to ████████ to observe normal site behavior (401 with login prompt)

████████

2. Navigate to the following vulnerable URL to set the cookie dos_poc=<script>alert(1)</script> on domain aws.dev :

████████cookies/set?dos_poc=<script>alert(1)</script>&attr[Domain]=aws.dev

████████

3. As impact, observe the cookie set by ████████ on aws.dev, triggers a WAF denial (on a single user) on ████████

████████

Impact

Summary:

• Cross-subdomain cookie injection/tossing: Plant attacker-controlled cookies scoped to *.aws.dev, causing them to be sent to unrelated sibling applications.
• Denial of service: Crafted cookie values can trigger CloudFront/WAF filtering and make affected applications inaccessible to the victim.
• Potential cookie shadowing: Attacker-controlled cookies may interfere with security or application cookies used by sibling applications.
• Open redirect: Redirect users from a trusted aws.dev URL to an attacker-controlled external destination.