Topic starter
25/10/2026 11:01 am
TL;DR: Rare HTTP/2 downgrade behaviour exposed cookies and other headers in cleartext, Corelight found at Black Hat Asia. Authentication paths that fail open can leak session material even when traffic appears to ride a trusted port.
Editorial analysis by NHI Mgmt Group, based on content published by Corelight: “Precarious exposure of cookies when QUIC rage quits”.
Key questions
Q: Why does rare protocol usage matter in threat hunting?
A: Rare protocols often reveal paths that normal baselines ignore, especially when they appear in combinations that should not exist together.
Q: How should teams verify that secure transport failures are handled safely?
A: Test the full client-to-service path under failure conditions and confirm that the application terminates rather than downgrades the session.
Q: What breaks when authentication traffic falls back to cleartext on a trusted port?
A: The security model breaks because operators and tools often assume the port implies encryption, while the application may still transmit cookies, headers, or tokens in readable form.
Practitioner guidance
- Review authentication flows for failed-open transport paths Trace every auth endpoint and client SDK path that can downgrade from encrypted to cleartext behaviour, then verify that the request is terminated when transport security is unavailable.
- Search for secrets in application-layer headers Inspect request headers, cookies, and query parameters on uncommon protocol paths so that session material is not assumed safe just because the connection uses a familiar port.
- Pivot rare events into population-level hunts Use DNS, connection, and service logs to determine whether a single odd request is isolated or part of a broader pattern across multiple clients and addresses.
Bottom line: The article shows a hidden failure mode where authentication traffic continued in cleartext and exposed session material that defenders would normally assume was protected.
Glossary terms: Cleartext HTTP/2, Failed-Open, Session Material, Threat Hunting
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:17 pm
Failed-open transport is an identity control failure, not just a network misconfiguration. When authentication traffic can continue after security negotiation breaks down, the session layer inherits the risk even if the packet itself looks routine. The article shows why defenders must treat transport fallback as part of identity governance, because cookies and headers are often the real access tokens in practice. Practitioners should review where secure transport assumptions are enforced and where they are merely preferred.
A question worth separating out:
Q: What should security teams do when cookies appear in plaintext network traffic?
A: Treat the finding as a possible session exposure event and scope it immediately across logs, clients, and related endpoints. Focus on what identity material was carried, how many clients were affected, and whether the same request path appears elsewhere. If the traffic is tied to authentication, the concern is not just confidentiality but unauthorised reuse of session state.
👉 Read our full editorial: Cleartext HTTP/2 auth traffic exposed cookies at Black Hat Asia
This post was modified 7 days ago by NHI Mgmt Group