{"id":"CVE-2026-78188","title":"WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes","summary":"WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes.\n\nWebDyne::Session sets its session cookie with only a name, value and path.\n\nBrowsers then send the session ID …","severity":"none","cwe":["CWE-614","CWE-1004","CWE-1275"],"product":"WebDyne","affected":["WebDyne >= 2.014 < 3.022"],"published":"2026-10-31","updated":"2026-10-31","sourceUpdated":"2026-10-31T14:33:37.285Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-78188","references":[{"url":"https://metacpan.org/release/ASPEER/WebDyne-3.022/changes"}],"tags":["cve.org"],"epss":0.00127,"epssPercentile":0.02348,"ingestedAt":"2026-11-05T16:24:31.546Z","slug":"CVE-2026-78188","body":"## Overview\n\nWebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes.\n\nWebDyne::Session sets its session cookie with only a name, value and path.\n\nBrowsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it.\n\n## Affected\n\n- `WebDyne >= 2.014 < 3.022`\n\n## Remediation\n\nUpgrade to WebDyne 3.022 or later. The SameSite attribute also requires CGI::Simple 1.22 or later.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}