CVE-2026-78188 Details
Description
WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes. WebDyne::Session sets its session cookie with only a name, value and path. Browsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it.
A vulnerability exists in WebDyne versions 2.014 prior to 3.022, where the application issues session cookies without the Secure, HttpOnly, and SameSite attributes. This oversight allows browsers to send the session ID over unencrypted HTTP and with cross-site requests, exposing it to page scripts. As a result, a network attacker or an injected script could steal the session, and another site could make requests using the hijacked session.
WebDyne versions 3.022 and later have addressed this vulnerability by adding default Secure, HttpOnly, and SameSite=Lax attributes to session cookies. Users should upgrade to WebDyne version 3.022 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 31, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/ASPEER/WebDyne-3.022/changes | CPANSec | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1004 | Sensitive Cookie Without 'HttpOnly' Flag | CPANSec |
| CWE-1275 | Sensitive Cookie with Improper SameSite Attribute | CPANSec |
| CWE-614 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| WebDyne | >= 2.014, < 3.022 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 31, 2026 | New CVE Received | CPANSec |