When a browser cannot reach a website over HTTP/3, it quietly falls back to HTTP/2 and carries on. This fallback is seamless by design — but it creates a security problem that has not been examined before. The session state a browser builds during an HTTP/3 connection, including authentication cookies and session resumption tickets, does not get cleared or re-checked when the switch happens. It simply carries over into the HTTP/2 connection, even though the two protocols operate under different security assumptions. We call this Cross-Protocol State Confusion (CPSC). We show that the relevant internet standards — the RFCs that govern HTTP/3, QUIC, HTTP/2, and the fallback mechanism itself — contain no guidance on what should happen to session state at this boundary. The gap is not a bug in any one protocol. It is an absence of a rule that nobody wrote. From this gap, three attack scenarios follow: an attacker can replay a session ticket issued under HTTP/3's security model against an HTTP/2 connection; session cookies set during HTTP/3 carry over to HTTP/2 with no revalidation; and security infrastructure such as firewalls and CDNs can be confused by the mid-session protocol switch. We estimate the severity as High under standard scoring criteria. We propose fixes at three levels: browsers should treat the fallback as a security event and revalidate session state; servers should bind session tokens to the transport protocol that issued them; and the standard that governs the fallback mechanism should be updated to require revalidation. We also describe a complete testing methodology so these findings can be independently verified.
S. Thomas (Sun,) studied this question.