Missing Encryption of Sensitive Data
Apache Guacamole uses a cookie for client-side storage of the user session token. This cookie lacks the secure flag, which could allow an attacker to steal the user session token if unencrypted HTTP requests are made to the same domain.