Session cookie missing HttpOnly
A session-like cookie does not set HttpOnly.
Why it matters
Page scripts can read it through document.cookie, so an XSS bug can steal the session.
What to do
Add HttpOnly unless JavaScript must read that cookie.
Reference
Cookie attributes such as Secure, HttpOnly, and SameSite protect session tokens in browsers.