Session cookie has no prefix
A session cookie on HTTPS does not use the __Host- or __Secure- prefix.
Why it matters
Those prefixes make the browser enforce Secure, and __Host- also forbids a Domain attribute.
What to do
Consider renaming a host-only session cookie to start with __Host-.
Reference
Cookie attributes such as Secure, HttpOnly, and SameSite protect session tokens in browsers.