WebDyne::Session sets its session cookie with only a name, value and path.
Browsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
No advisories yet.
Solution
Upgrade to WebDyne 3.022 or later. The SameSite attribute also requires CGI::Simple 1.22 or later.
Workaround
No workaround given by the vendor.
| Link | Providers |
|---|---|
| https://metacpan.org/release/ASPEER/WebDyne-3.022/changes |
|
Sat, 31 Oct 2026 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes. WebDyne::Session sets its session cookie with only a name, value and path. Browsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it. | |
| Title | WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes | |
| Weaknesses | CWE-1004 CWE-1275 CWE-614 |
|
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-10-31T14:33:37.285Z
Reserved: 2026-08-23T18:38:50.604Z
Link: CVE-2026-78188
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-31T15:16:53.860
Modified: 2026-10-31T15:16:53.860
Link: CVE-2026-78188
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-31T16:00:10Z