In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings
CWE-614, CWE-319