Live › vulnerability › CVE-2026-78188
WebDyne, a Perl framework for web pages, sets its session cookie without the Secure, HttpOnly or SameSite attributes. An attacker on the network or an injected script can read the session ID and reuse it, and another site can send requests that carry the session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 15:36 UTC. All times on this page are UTC.
Applications built with WebDyne that use its session handling are affected, since the session cookie is the problem. Sites that only serve static pages or do not use WebDyne::Session are not affected. Any site that serves sessions over plain HTTP or allows cross-site requests carries the most risk.
No product ranges from the sources yet.
perl -MWebDyne -e 'print $WebDyne::VERSION'2.014 before 3.022: move to 3.022 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes.
WebDyne::Session sets its session cookie with only a name, value and path.
Browsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it.
This page as .md · .json · in your agent: get_signal("CVE-2026-78188")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.