CVE-2026-78188

Full vulnerability record from the local CVENow database.

Description

WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes. WebDyne::Session sets its session cookie with only a name, value and path. Browsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

9b29abf9-4ab0-4765-b253-1875cd9b441e

Published

2026-10-31 15:16:53.860000

Last modified

2026-10-31 15:16:53.860000

View original CVE JSON

{
  "id": "CVE-2026-78188",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-10-31T15:16:53.860",
  "lastModified": "2026-10-31T15:16:53.860",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes.\n\nWebDyne::Session sets its session cookie with only a name, value and path.\n\nBrowsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "WebDyne",
          "modules": [
            "WebDyne"
          ],
          "programFiles": [
            "lib/WebDyne/Session.pm"
          ],
          "programRoutines": [
            {
              "name": "WebDyne::Session::handler"
            }
          ],
          "repo": "https://github.com/aspeer/WebDyne",
          "packageURL": "pkg:cpan/WebDyne",
          "versions": [
            {
              "version": "2.014",
              "lessThan": "3.022",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-614"
        },
        {
          "lang": "en",
          "value": "CWE-1004"
        },
        {
          "lang": "en",
          "value": "CWE-1275"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://metacpan.org/release/ASPEER/WebDyne-3.022/changes",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    }
  ]
}