How to use CPA on AES128-CBC with constant Key and IV to leak info?
The strategy you need to apply here, is basically the same as with most other oracle attacks:

You construct a message such that you can verify your guess for a single byte, then you adapt to guess the next byte until you are done.

In this specific case you would pick the user-controlled message length such that one byte of the cookie is in the same block as the tail of your message, encrypt that. Then you make your input one byte longer and try all possible values for the cookie byte until the corresponding block is equal to the encryption of the cookie byte.

Now you repeat this process for the second byte and so on.