WebDyne::Session sets its session cookie with only a name, value and path.
Browsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to WebDyne 3.022 or later. The SameSite attribute also requires CGI::Simple 1.22 or later.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://metacpan.org/release/ASPEER/WebDyne-3.022/changes |
|
Sat, 31 Oct 2026 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes. WebDyne::Session sets its session cookie with only a name, value and path. Browsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it. | |
| Title | WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes | |
| Weaknesses | CWE-1004 CWE-1275 CWE-614 |
|
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-10-31T14:33:37.285Z
Reserved: 2026-08-23T18:38:50.604Z
Link: CVE-2026-78188
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-31T15:16:53.860
Modified: 2026-10-31T15:16:53.860
Link: CVE-2026-78188
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-31T16:00:10Z