{"id":"CVE-2026-78188","aliases":[],"cve":{"records":[{"id":"CVE-2026-78188","source":"CPANSec","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-08-23T18:38:50.604Z","published":"2026-10-31T14:33:37.285Z","modified":"2026-11-06T13:51:13.611Z"}],"publishers":[{"name":"CPANSec","role":"CNA","organizationId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","modified":"2026-10-31T14:33:37.285Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-06T13:51:13.611Z"}],"references":[{"url":"https://metacpan.org/release/ASPEER/WebDyne-3.022/changes","tags":["release-notes"],"source":"CPANSec"}],"weaknesses":[{"id":"CWE-614","description":"CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","source":"CPANSec"},{"id":"CWE-1004","description":"CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag","source":"CPANSec"},{"id":"CWE-1275","description":"CWE-1275 Sensitive Cookie with Improper SameSite Attribute","source":"CPANSec"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-06T13:50:42.577536Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes","titleSource":"CPANSec","descriptionSource":"CPANSec","description":"WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes.\n\nWebDyne::Session sets its session cookie with only a name, value and path.\n\nBrowsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it.","score":5.4,"severity":"medium","published":"2026-10-31T14:33:37.285Z","modified":"2026-11-06T13:51:13.611Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"","name":"WebDyne","platforms":[],"versions":[{"version":"2.014","status":"affected","lessThan":"3.022","versionType":"custom"}],"defaultStatus":"unaffected","packageURL":"pkg:cpan/WebDyne","cpes":[],"source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-78188"}],"remediation":[{"text":"Upgrade to WebDyne 3.022 or later. The SameSite attribute also requires CGI::Simple 1.22 or later.","source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-78188"}],"references":["https://metacpan.org/release/ASPEER/WebDyne-3.022/changes"],"sources":[{"name":"CVE","id":"CVE-2026-78188","modified":"2026-11-06T13:51:13.611Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-78188"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","score":5.4}],"sourceAffected":[],"observedAt":"2026-11-06T14:13:01.332Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:55:32.844Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-31T14:45:33.730Z","attemptedAt":"2026-10-31T14:45:33.730Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-31T14:45:34.151Z","attemptedAt":"2026-10-31T14:45:34.151Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-10-31T14:45:32.400Z","attemptedAt":"2026-10-31T14:45:32.400Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-31T14:45:34.152Z","attemptedAt":"2026-10-31T14:45:34.152Z"}],"evidence":[],"aiSummary":{"text":"WebDyne versions 2.014 before 3.022 for Perl issue session cookies without Secure, HttpOnly, and SameSite attributes, allowing a network attacker or injected script to steal the session. Browsers send the session ID over plain HTTP and with cross-site requests. This exposes the session ID to page scripts.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T14:41:08.659Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-78188"}]}}