---
id: CVE-2026-78188
title: >-
  WebDyne versions from 2.014 before 3.022 for Perl issue session cookies
  without the Secure, HttpOnly and SameSite attributes
summary: >-
  WebDyne versions from 2.014 before 3.022 for Perl issue session cookies
  without the Secure, HttpOnly and SameSite attributes.


  WebDyne::Session sets its session cookie with only a name, value and path.


  Browsers then send the session ID …
severity: none
cwe:
  - CWE-614
  - CWE-1004
  - CWE-1275
product: WebDyne
affected:
  - WebDyne >= 2.014 < 3.022
published: '2026-10-31'
updated: '2026-10-31'
sourceUpdated: '2026-10-31T14:33:37.285Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-78188'
references:
  - url: 'https://metacpan.org/release/ASPEER/WebDyne-3.022/changes'
tags:
  - cve.org
epss: 0.00127
epssPercentile: 0.02348
ingestedAt: '2026-11-05T16:24:31.546Z'
---

## Overview

WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes.

WebDyne::Session sets its session cookie with only a name, value and path.

Browsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it.

## Affected

- `WebDyne >= 2.014 < 3.022`

## Remediation

Upgrade to WebDyne 3.022 or later. The SameSite attribute also requires CGI::Simple 1.22 or later.