Vulnerability · Published Oct 31, 2026 · Assigned by CPANSec
CVE-2026-78188WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes
Unrated
In plain English
A security flaw in WebDyne. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Severity (CVSS )–Not rated
Exploit odds (30 days)0.1%top 97.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes. WebDyne::Session sets its session cookie with only a name, value and path. Browsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WebDyne | 2.014 – before 3.022 |
Weakness: CWE-614, CWE-1004, CWE-1275