Vulnerability · Published Jun 29, 2026 · Assigned by VulnCheck

CVE-2026-57948Pinpoint - Insecure Session Cookie Attributes in pinpointJwt

Medium 6.8

In plain English

A medium-severity security flaw in pinpoint from pinpoint-apm. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.2%top 94.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to missing HttpOnly and Secure attributes, enabling JavaScript access via document.cookie and cleartext transmission over HTTP. Attackers can exploit stored or reflected cross-site scripting vulnerabilities to exfiltrate the session token or intercept it through network sniffing to perform session hijacking.

Affected products (as reported)

Vendor	Product	Versions
pinpoint-apm	pinpoint	0 – through 3.1.0

Weakness: CWE-1004, CWE-614 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

References

Researcher Disclosure issue-tracking
https://www.vulncheck.com/advisories/pinpoint-insecure-session-cookie-attributes-in-pinpointjwt third-party-advisory