UNKNOWNCVSS not yet scoredVulnerability
CVE-2026-78188
WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes. WebDyne::Session sets its session cookie with only a name, value and path. Browsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it.
Properties
- Last source
- NVD
- Nvd fetched at
- 2026-10-31T16:18:41.203339+00:00
- Cve id
- CVE-2026-78188
- First seen by Signal
- 2026-10-31T16:19:23+00:00
- Retrieved at
- 2026-10-31T16:19:23+00:00
- Published at
- 2026-10-31T15:16:53.860
- Last modified
- 2026-10-31T15:16:53.860
Related Entities (3)
HAS_WEAKNESS (3)
Explore deeper with Ninja Signal's threat intelligence graph