CVE-2026-78188: WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes

Published Oct 31, 2026

Updated

WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes.

WebDyne::Session sets its session cookie with only a name, value and path.

Browsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it.

Event History

Oct 31, 2026

CVE Published

via MITRE·02:33 PM

Data Sourced

via MITRE·02:33 PM

RemedyDescriptionWeakness

Data Sourced

via OSV·02:33 PM

DescriptionWeakness

Data Sourced

via NVD·03:16 PM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to session theft or cross-site request attacks?

Applications using affected WebDyne versions and WebDyne::Session are exposed because their session cookie lacks Secure, HttpOnly, and SameSite attributes. Users are at risk when they access the application over plain HTTP, encounter an injected script, or are induced to visit another site that sends requests to the application.

What capabilities does an attacker need to exploit this issue?

A network attacker needs the ability to observe plain HTTP traffic to capture the session ID. An attacker with injected script execution can read the cookie, while a separate site can cause cross-site requests that include the session cookie.

How can I determine whether an application is affected?

Check whether it uses WebDyne from version 2.014 up to, but not including, 3.022. Inspect session responses from WebDyne::Session: affected cookies are set with only a name, value, and path, without Secure, HttpOnly, or SameSite attributes.

CVE-2026-78188: WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes

Event History

Frequently Asked Questions

Who is exposed to session theft or cross-site request attacks?

What capabilities does an attacker need to exploit this issue?

How can I determine whether an application is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to session theft or cross-site request attacks?

What capabilities does an attacker need to exploit this issue?

How can I determine whether an application is affected?