Riskcovery

CVE-2026-78188

WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes

State
Published
Severity
Not scored
Published
Oct 31, 2026
Updated
Oct 31, 2026
Reserved
Aug 23, 2026

Read the record on cve.org

Description

WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes.

WebDyne::Session sets its session cookie with only a name, value and path.

Browsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it.

Scores

The record has no CVSS score.

Weaknesses

  • CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
  • CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag
  • CWE-1275 Sensitive Cookie with Improper SameSite Attribute

Affected Products

ProductVersions
WebDyne
  • 2.014 to before 3.022Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.