When a vulnerability lives in a network library rather than an end-user app, the blast radius is often much larger than the CVSS score alone suggests. That is the case with CVE-2026-5119, a libsoup flaw that can leak session cookies in cleartext during HTTPS tunnel establishment through an HTTP...