CVE-2026-78188
Received Received - Intake

Session Cookie Security Flaws in WebDyne

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: CPANSec

Description
WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes. WebDyne::Session sets its session cookie with only a name, value and path. Browsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-78188
EUVD
EUVD-2026-114714

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
webdyne session to 3.022 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1275 The SameSite attribute for sensitive cookies is not set, or an insecure value is used.
CWE-614 The Secure attribute for sensitive cookies in HTTPS sessions is not set.
CWE-1004 The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects WebDyne versions from 2.014 before 3.022 for Perl. Session cookies are set without Secure, HttpOnly, and SameSite attributes, making them vulnerable to theft via plain HTTP or cross-site requests.

Detection Guidance

To detect this vulnerability, inspect session cookies set by WebDyne applications for missing Secure, HttpOnly, and SameSite attributes. Use browser developer tools or commands like curl to check cookie headers for these attributes. Example: curl -I http://your-webdyne-site.com | grep -i set-cookie

Check WebDyne configuration files for session cookie settings. Look for Perl modules handling sessions, particularly WebDyne::Session, to verify cookie attributes are properly configured.

Impact Analysis

An attacker could steal session cookies through network interception or malicious scripts. This allows unauthorized access to user sessions, potentially leading to account hijacking or data breaches.

Compliance Impact

This vulnerability may violate GDPR's requirement for secure data transmission and HIPAA's safeguards for protected health information. Non-compliance could result in legal penalties or data protection fines.

Mitigation Strategies

Update WebDyne to version 3.022 or later to ensure session cookies include Secure, HttpOnly, and SameSite attributes. If updating is not immediately possible, manually configure the application to set these attributes in session cookie generation.

Implement HTTPS for all WebDyne sessions to enable the Secure attribute. Use secure headers and CSP policies to reduce exposure to cross-site scripting attacks that could exploit this vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78188. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart