Merge document vulnerability CVE-2018-1340, fixed in 1.0.0.
diff --git a/_security/CVE-2018-1340.md b/_security/CVE-2018-1340.md
new file mode 100644
index 0000000..83abb74
--- /dev/null
+++ b/_security/CVE-2018-1340.md
@@ -0,0 +1,13 @@
+---
+title: Secure flag missing from session cookie
+cve: CVE-2018-1340
+fixed: 1.0.0
+---
+
+Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the
+user's session token. This cookie lacked the "secure" flag, which could allow
+an attacker eavesdropping on the network to intercept the user's session token
+if unencrypted HTTP requests are made to the same domain.
+
+Acknowledgements: We would like to thank Ross Golder for reporting this issue.
+
