Vulnerability record/PUBLISHED/Published Oct 31, 2026 14:33:37 UTC
CVE-2026-78188
WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes. WebDyne::Session sets its session cookie with only a name, value and path. Browsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it.
Base scoreN/A/ 10
SeverityNoneCVSS unscored
Exploitability / impact
CVSS metric breakdown
Base severityNone
No CVSS vector is available for this record.
CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityCPANSec
Last updatedOct 31, 2026 14:33:37 UTC
PublishedOct 31, 2026 14:33:37 UTC
ReservedAug 23, 2026 18:38:50 UTC