CVE-2025-26844: Critical severity znuny vulnerability
Published May 8, 2025
·Updated
An issue was discovered in Znuny through 7.1.3. A cookie is set without the HttpOnly flag.
Affected Software
2 affected components
Znuny Znuny<=7.1.3
Znuny Znuny<=7.1.3
Event History
May 8, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-26844?
CVE-2025-26844 has a moderate severity level due to potential exposure of sensitive cookie data.
2
How do I fix CVE-2025-26844?
To fix CVE-2025-26844, ensure that cookies are set with the HttpOnly flag in your Znuny configuration.
3
What versions of Znuny are affected by CVE-2025-26844?
CVE-2025-26844 affects all Znuny versions up to and including 7.1.3.
4
What type of vulnerability is CVE-2025-26844?
CVE-2025-26844 is a security vulnerability related to improper cookie handling.
5
What are the potential risks of CVE-2025-26844?
The risks of CVE-2025-26844 include the possibility of session hijacking from the lack of HttpOnly protection on cookies.