{"id":"CVE-2026-78188","published":"2026-10-31T15:16:53.860","lastModified":"2026-10-31T15:16:53.860","description":"WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes.\n\nWebDyne::Session sets its session cookie with only a name, value and path.\n\nBrowsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-614","CWE-1004","CWE-1275"],"vendors":[],"products":[],"references":[{"url":"https://metacpan.org/release/ASPEER/WebDyne-3.022/changes","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}